Accident Analysis for Nuclear Power Plants with Pressurized Water Reactors

Document Sample
Accident Analysis for Nuclear Power Plants with Pressurized Water Reactors Powered By Docstoc
					Safety Reports Series
                N o. 3 0

               Accident Analysis
       for Nuclear Power Plants
with Pressurized Water Reactors

       Under the terms of Article III of its Statute, the IAEA is authorized to establish standards
of safety for protection against ionizing radiation and to provide for the application of these
standards to peaceful nuclear activities.
       The regulatory related publications by means of which the IAEA establishes safety
standards and measures are issued in the IAEA Safety Standards Series. This series covers
nuclear safety, radiation safety, transport safety and waste safety, and also general safety (that
is, of relevance in two or more of the four areas), and the categories within it are Safety
Fundamentals, Safety Requirements and Safety Guides.
Safety Fundamentals (blue lettering) present basic objectives, concepts and principles of
      safety and protection in the development and application of nuclear energy for peaceful
Safety Requirements (red lettering) establish the requirements that must be met to ensure
      safety. These requirements, which are expressed as ‘shall’ statements, are governed by
      the objectives and principles presented in the Safety Fundamentals.
Safety Guides (green lettering) recommend actions, conditions or procedures for meeting
      safety requirements. Recommendations in Safety Guides are expressed as ‘should’ state-
      ments, with the implication that it is necessary to take the measures recommended or
      equivalent alternative measures to comply with the requirements.
        The IAEA’s safety standards are not legally binding on Member States but may be
adopted by them, at their own discretion, for use in national regulations in respect of their own
activities. The standards are binding on the IAEA in relation to its own operations and on States
in relation to operations assisted by the IAEA.
       Information on the IAEA’s safety standards programme (including editions in languages
other than English) is available at the IAEA Internet site
or on request to the Safety Co-ordination Section, IAEA, P.O. Box 100, A-1400 Vienna,

       Under the terms of Articles III and VIII.C of its Statute, the IAEA makes available and
fosters the exchange of information relating to peaceful nuclear activities and serves as an
intermediary among its Member States for this purpose.
       Reports on safety and protection in nuclear activities are issued in other series, in
particular the IAEA Safety Reports Series, as informational publications. Safety Reports may
describe good practices and give practical examples and detailed methods that can be used to
meet safety requirements. They do not establish requirements or make recommendations.
       Other IAEA series that include safety related publications are the Technical Reports
Series, the Radiological Assessment Reports Series, the INSAG Series, the TECDOC
Series, the Provisional Safety Standards Series, the Training Course Series, the IAEA
Services Series and the Computer Manual Series, and Practical Radiation Safety Manuals
and Practical Radiation Technical Manuals. The IAEA also issues reports on radiological
accidents and other special publications.
         The following States are Members of the International Atomic Energy Agency:
AFGHANISTAN                    GREECE                            PARAGUAY
ALBANIA                        GUATEMALA                         PERU
ALGERIA                        HAITI                             PHILIPPINES
ANGOLA                         HOLY SEE                          POLAND
ARGENTINA                      HONDURAS                          PORTUGAL
ARMENIA                        HUNGARY                           QATAR
AUSTRALIA                      ICELAND
                                                                 REPUBLIC OF MOLDOVA
AUSTRIA                        INDIA
AZERBAIJAN                     INDONESIA
BELARUS                        IRAQ                              SAUDI ARABIA
BELGIUM                        IRELAND                           SENEGAL
BENIN                          ISRAEL                            SERBIA AND MONTENEGRO
BOLIVIA                        ITALY                             SEYCHELLES
BOSNIA AND                     JAMAICA                           SIERRA LEONE
 HERZEGOVINA                   JAPAN                             SINGAPORE
BOTSWANA                       JORDAN                            SLOVAKIA
BRAZIL                         KAZAKHSTAN                        SLOVENIA
BULGARIA                       KENYA                             SOUTH AFRICA
BURKINA FASO                   KOREA, REPUBLIC OF                SPAIN
CAMEROON                       KUWAIT                            SRI LANKA
CANADA                         KYRGYZSTAN
 REPUBLIC                      LEBANON
CHILE                          LIBERIA                           SWITZERLAND
COLOMBIA                       LIECHTENSTEIN                     TAJIKISTAN
COSTA RICA                     LITHUANIA                         THAILAND
CÔTE D’IVOIRE                  LUXEMBOURG                        THE FORMER YUGOSLAV
CROATIA                        MADAGASCAR                         REPUBLIC OF MACEDONIA
CUBA                           MALAYSIA                          TUNISIA
CYPRUS                         MALI                              TURKEY
CZECH REPUBLIC                 MALTA                             UGANDA
 OF THE CONGO                  MAURITIUS                         UNITED ARAB EMIRATES
DENMARK                        MEXICO                            UNITED KINGDOM OF
DOMINICAN REPUBLIC             MONACO                             GREAT BRITAIN AND
ECUADOR                        MONGOLIA                           NORTHERN IRELAND
EGYPT                          MOROCCO                           UNITED REPUBLIC
EL SALVADOR                    MYANMAR                            OF TANZANIA
ERITREA                        NAMIBIA
                                                                 UNITED STATES OF AMERICA
ESTONIA                        NETHERLANDS
ETHIOPIA                       NEW ZEALAND
FINLAND                        NICARAGUA                         UZBEKISTAN
FRANCE                         NIGER                             VENEZUELA
GABON                          NIGERIA                           VIETNAM
GEORGIA                        NORWAY                            YEMEN
GERMANY                        PAKISTAN                          ZAMBIA
GHANA                          PANAMA                            ZIMBABWE

        The Agency’s Statute was approved on 23 October 1956 by the Conference on the Statute
of the IAEA held at United Nations Headquarters, New York; it entered into force on 29 July 1957.
The Headquarters of the Agency are situated in Vienna. Its principal objective is “to accelerate and
enlarge the contribution of atomic energy to peace, health and prosperity throughout the world’’.
                                          © IAEA, 2003
      Permission to reproduce or translate the information contained in this publication may be
obtained by writing to the International Atomic Energy Agency, Wagramer Strasse 5, P.O. Box 100,
A-1400 Vienna, Austria.
                                 Printed by the IAEA in Austria
                                         November 2003


               VIENNA, 2003
IAEA Library Cataloguing in Publication Data
Accident analysis for nuclear power plants with pressurized water
    reactors. — Vienna : International Atomic Energy Agency, 2003.
        p. ; 24 cm. — (Safety reports series, ISSN 1020–6450 ; no. 30)
    ISBN 92–0–110603–3
    Includes bibliographical references.
     1. Pressurized water reactors. 2. Nuclear power plants — Accidents.
  I. International Atomic Energy Agency. II. Series.
  IAEAL                                                       03–00333

       Deterministic safety analysis (frequently referred to as accident analysis) is
an important tool for confirming the adequacy and efficiency of provisions within
the defence in depth concept for the safety of nuclear power plants (NPPs).
Owing to the close interrelationship between accident analysis and safety, an
analysis that lacks consistency, is incomplete or of poor quality is considered to
be a safety issue for a given NPP. Developing IAEA guidance publications for
accident analysis is thus an important step towards resolving this issue.
       Requirements and guidance pertaining to the scope and content of
accident analysis have, in the past, been partially described in various IAEA
reports. Several guidance documents relevant to water moderated, water
cooled power reactors (WWERs) and high power boiling reactors with
pressurized channels of Russian design known as RBMKs have been
developed within the IAEA’s Extra-budgetary Programme on the Safety of
WWER and RBMK Nuclear Power Plants. To a certain extent, accident
analysis is also covered in several publications of the revised NUSS Series, for
example, in the Safety Requirements on Safety of Nuclear Power Plants:
Design (NS-R-1) and in the Safety Guide on Safety Assessment and
Verification for Nuclear Power Plants (NS-G-1.2). For consistency with these
publications, the IAEA has developed a series of Safety Reports on Accident
Analysis for Nuclear Power Plants. Many experts have contributed to the
development of these Safety Reports. In addition to several consultants’
meetings, comments were collected from more than fifty selected
organizations. These reports were also reviewed at the IAEA Technical
Committee Meeting on Accident Analysis held in Vienna from 30 August to
3 September 1999.
       These Safety Reports aim to provide practical guidance for performing
accident analysis. The guidance is based on present good practice worldwide.
The reports cover all the steps required for accident analyses, i.e. selection of
initiating events and acceptance criteria, selection of computer codes and
modelling assumptions, preparation of input data and presentation of the
calculation results. The reports also discuss the various aspects that need to be
considered to ensure that an accident analysis is of acceptable quality.
       The first volume of the series is intended to be as generally applicable as
possible to all reactor types. The specific features of individual reactor types are
taken into account in the subsequent reports in the series. The reactor types to
be covered include pressurized water reactors (PWRs), boiling water reactors
(BWRs), pressurized heavy water reactors (PHWRs) or more specifically
PHWRs of Canadian design known as CANDU, and RBMKs. The present
report is devoted to specific guidance for PWRs.
     The report is intended for use primarily by analysts co-ordinating,
performing or reviewing accident analysis for NPPs, on both the utility and the
regulatory sides. The report will also be used as a background publication for
relevant IAEA activities, such as training courses and workshops.
     The IAEA staff member responsible for this publication was J. Mišák of
the Division of Nuclear Installation Safety.

                                  EDITORIAL NOTE

        Although great care has been taken to maintain the accuracy of information con-
tained in this publication, neither the IAEA nor its Member States assume any responsi-
bility for consequences which may arise from its use.
        The mention of names of specific companies or products (whether or not indicated
as registered) does not imply any intention to infringe proprietary rights, nor should it be
construed as an endorsement or recommendation on the part of the IAEA.

1.   INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .                   1

     1.1.    Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .         1
     1.2.    Objective . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .      2
     1.3.    Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .    2
     1.4.    Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .      3

2.   INITIATING EVENTS AND THEIR CATEGORIZATION . . . .                                                               4

3.   ACCEPTANCE CRITERIA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .                            8

     3.1. Acceptance criteria for transients . . . . . . . . . . . . . . . . . . . . . . . .                         8
     3.2. Acceptance criteria for design basis accidents . . . . . . . . . . . . . .                                 8
     3.3. Acceptance criteria for all accidents leading to
          containment pressurization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .                      9
     3.4. Acceptance criteria for pressurized thermal shock
          analysis of accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .              10
     3.5. Acceptance criteria for accidents occuring during shutdown . .                                             10
     3.6. Acceptance criteria for severe accidents . . . . . . . . . . . . . . . . . . .                             10

4.   SELECTION OF INITIAL AND BOUNDARY CONDITIONS . .                                                                11

     FOR REACTIVITY INDUCED ACCIDENTS . . . . . . . . . . . . . . . .                                                14

     5.1. Control rod ejection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .               14
     5.2. Control rod withdrawal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .                   16
     5.3. Control rod malfunction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .                    17
     5.4. Incorrect connection of an inactive
          reactor coolant system loop . . . . . . . . . . . . . . . . . . . . . . . . . . . . .                      18
     5.5. Boron dilution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .           19
     5.6. Inadvertent loading of a fuel assembly into
          an improper position . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .                 20

     FOR A DECREASE OF REACTOR COOLANT FLOW . . . . . . .                                                            21

     6.1. Single or multiple MCP trip . . . . . . . . . . . . . . . . . . . . . . . . . . . . .                      21
      6.2. Inadvertent closure of a main isolation valve in
           a reactor coolant system loop . . . . . . . . . . . . . . . . . . . . . . . . . . . .           22
      6.3. Seizure of one main circulation pump or
           shaft break of one main circulation pump . . . . . . . . . . . . . . . . .                      22
      6.4. Coolant flow blockage in a fuel assembly . . . . . . . . . . . . . . . . . .                    23

      INCREASE OF REACTOR COOLANT INVENTORY . . . . . . . .                                                23

      7.1. Inadvertent actuation of the emergency core cooling system . .                                  23
      7.2. Malfunctions in the chemical and volume control systems . . .                                   24

      BY THE SECONDARY SIDE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .                  25

      8.1. Steam line breaks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .   25
      8.2. Inadvertent opening of steam relief valves . . . . . . . . . . . . . . . . .                    27
      8.3. Secondary pressure control malfunction with an
           increase of steam flow rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .         28
      8.4. Feedwater system malfunction . . . . . . . . . . . . . . . . . . . . . . . . . . .              28

      BY THE SECONDARY SIDE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .                  29

      9.1. Feedwater line break . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .      29
      9.2. Feedwater pump trip . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .       30
      9.3. Reduction of steam flow from steam generator
           for various reasons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .   31

10.   ANALYSIS OF CORE COOLING FOR LOCAs . . . . . . . . . . . . . . .                                     31

      10.1. Initiating events and safety aspects . . . . . . . . . . . . . . . . . . . . . . .             31
      10.2. Specific suggestions for analysis . . . . . . . . . . . . . . . . . . . . . . . . . .          33

      SYSTEM LEAKAGE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .         35

      11.1. Initiating events and safety aspects . . . . . . . . . . . . . . . . . . . . . . .             35
      11.2. Specific suggestions for analysis . . . . . . . . . . . . . . . . . . . . . . . . . .          36
      WITHOUT SCRAM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .   38

      12.1. Initiating events and safety aspects . . . . . . . . . . . . . . . . . . . . . . .        38
      12.2. Specific suggestions for analysis . . . . . . . . . . . . . . . . . . . . . . . . . .     39

13.   ANALYSIS OF BORON DILUTION ACCIDENTS . . . . . . . . . . . .                                    41

      13.1. Initiating events and safety aspects . . . . . . . . . . . . . . . . . . . . . . .        41
      13.2. Specific suggestions for analysis . . . . . . . . . . . . . . . . . . . . . . . . . .     42

14.   ANALYSIS OF PRESSURIZED THERMAL SHOCKS . . . . . . . .                                          43

      14.1. Initiating events and safety aspects . . . . . . . . . . . . . . . . . . . . . . .        43
      14.2. Specific suggestions for analysis . . . . . . . . . . . . . . . . . . . . . . . . . .     44

      OPERATIONAL MODES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .           46

      15.1. Initiating events and safety aspects . . . . . . . . . . . . . . . . . . . . . . .        46
      15.2. Specific suggestions for analysis . . . . . . . . . . . . . . . . . . . . . . . . . .     47

      TRANSIENTS IN THE CONTAINMENT . . . . . . . . . . . . . . . . . . . .                           50

      16.1. Short term containment pressurization . . . . . . . . . . . . . . . . . . . .             50
      16.2. Long term pressure–temperature transients . . . . . . . . . . . . . . . .                 52

      DURING DESIGN BASIS ACCIDENTS . . . . . . . . . . . . . . . . . . . . .                         55

      17.1. Initiating events and safety aspects . . . . . . . . . . . . . . . . . . . . . . .        55
      17.2. Specific suggestions for analysis . . . . . . . . . . . . . . . . . . . . . . . . . .     55

18.   ANALYSIS OF SEVERE ACCIDENTS . . . . . . . . . . . . . . . . . . . . . . .                      57

      18.1. Initiating events and safety aspects . . . . . . . . . . . . . . . . . . . . . . .        57
      18.2. Specific suggestions for analysis . . . . . . . . . . . . . . . . . . . . . . . . . .     58

19.   SUGGESTIONS ON REPORTING OF RESULTS . . . . . . . . . . . . .                                   60
REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .   63
CONTRIBUTORS TO DRAFTING AND REVIEW . . . . . . . . . . . . . . . .                                            65
                           1. INTRODUCTION


      Consistent with the revised Safety Standards Series, in particular with the
Safety Requirements on Safety of Nuclear Power Plants: Design [1] and the
Safety Guide on Safety Assessment and Verification [2], the IAEA has
developed a Safety Report on Accident Analysis of Nuclear Power Plants
containing a comprehensive description of the general methodology for
accident analysis [3]. The objective of that Safety Report is to establish a set of
practical suggestions based on the best practice worldwide for performing
accident analysis for nuclear power plants (NPPs). The following items are
covered in that report:

(1)   Classification of initiating events and acceptance criteria;
(2)   Methodology used for the analysis;
(3)   Types of accident analysis;
(4)   Computer codes;
(5)   User effects on the analysis;
(6)   Input data preparation;
(7)   Presentation and evaluation of results;
(8)   Quality assurance.

     Annexes to Ref. [3] provide examples of the practical application of
accident analysis; they specify and characterize the main steps in performing
accident analysis, provide more discussion on and examples of uncertainty
analysis, give a practical example of the preparation of input data for analysis
and of the production of the corresponding documents. The annexes also
contain references to the typical computer codes, provide an extensive list of
codes for accident analysis and include explanations of technical terms used in
the main report and its appendices. That Safety Report [3] is general in nature
and does not focus exclusively on any single reactor type.
     More specific guidance on performing accident analysis depends on the
characteristics of the NPP in question and can only be developed for specific
reactor designs or, in a more general manner, for a group of reactor designs.
Such design specific guidance documents are being developed as separate
Safety Reports. The reactor types to be covered include pressurized water
reactors (PWRs), boiling water reactors (BWRs), pressurized heavy water
reactors (PHWRs) or, more specifically, PHWRs of Canadian design known as

CANDUs, and high power boiling reactors with pressurized channels (of
Russian design) known as RBMKs.


      The objective of the present report is to provide specific guidance for
accident analysis for NPPs with PWRs, taking into account the specific design
features of these reactors. This guidance contains a detailed list of initiating
events with their direct causes and an overview of the safety aspects of the
event leading to potential degradation of the barriers against release of the
radioactive material. Licensing type safety analyses, aimed at demonstration of
sufficient safety margins, are mainly addressed. The analysis methodology for
the various events differs mainly in the selection of the acceptance criteria and
in the level of conservatism required in the analysis. Examples of acceptance
criteria are also provided. Conservative assumptions (i.e. those leading to more
pessimistic results) for typical initial parameters and boundary conditions are
indicated. Suggestions on the selection of acceptance criteria as well as initial
conditions and boundary conditions are provided. Specific methodological
instructions on how to perform the analysis of individual events are given. Lists
of output parameters to be presented for various events are suggested.
      This report is mostly based on the experience of the experts involved,
with considerable use of other relevant IAEA documents [4–9] and national
documents [10–16].

1.3. SCOPE

      In a similar way to the first volume of this series, Ref. [3], this PWR
specific volume also deals only with ‘internal’ events originating in the reactor
or in its associated process systems. It does not cover originating events
affecting broad areas of the plant (often called internal and external hazards),
such as fires, floods (internal and external), earthquakes and aircraft crashes.
However, analysis of the consequences of these events from a thermohydraulic
point of view is partially covered by the present guidance. The emphasis in this
guidance is on the transient behaviour of the reactor and its systems, including
the containment and/or confinement.
      The main focus of the analyses is towards the thermohydraulic aspects of
the transients considered. The neutronic and radiological aspects are also
covered to some extent. Limited consideration is given to structural
(mechanical) aspects.

      This report deals with both best estimate and conservative accident
analyses. Although originally all the NPPs were licensed using a fully conser-
vative approach (conservative code and conservative input data), such an
approach can be misleading in a number of applications. Thus the use of best
estimate computer codes and tools is encouraged, but always in such a way that
sufficient safety margins are ensured for all applications aimed at the demon-
stration of plant safety.
      The report covers both design basis accident (DBA) and beyond design
basis accident (BDBA) situations; however, BDBA events are covered to a
much lesser extent, since specific guidance documents are envisaged to cover
the complex area of severe accidents (SAs) with significant core damage.
      The information provided by this report is intended primarily for code
users performing accident analysis. Regulatory bodies are encouraged to use
this report as the basis for their national requirements. It may also be used by
analysts as a reference for contacts with the national regulatory body or for the
formulation of detailed company procedures for analysts.
      This report in the series, along with all the other design specific reports, is
intended to be, to a large extent, a self-standing publication. Nevertheless, to
avoid repetition of suggestions included already in the general guidance, it is
advisable for users to read the first volume in the series, Ref. [3], before using
any of the design specific guidance reports.


      The structure of the present report is consistent with that of the first
Safety Report in the series, Ref. [3]. Naturally, the content of the sections and
the level of detail take into account the design specific features of PWRs.
Whenever considered to be important, reference is made to the general
guidance given in Ref. [3]. In addition to this introductory section, there are 18
sections in this report.
      Section 2 deals with the proper selection and categorization of initiating
events. The characteristic physical phenomena are the basis for the selection
and classification of the events. According to the frequency of their occurrence,
initiating events are put into one of two categories, either anticipated
operational occurrences (AOOs), also known as transients (Ts) or accidents
(As). Accidents are further subdivided into DBAs, BDBAs and SAs. An
appropriate grouping of events, for which a similar approach can be used, is
      In Section 3 the acceptance criteria for accident analysis applicable to
PWRs are presented. Different sets of criteria for different categories of events

are given. Since setting up acceptance criteria rests with national regulatory
authorities, the criteria provided in this report can only be understood as
      Section 4 provides a short description of ways to ensure sufficient safety
margins by proper selection of the initial conditions and some boundary
conditions for the accident analysis. Suggestions are provided in relation to how
the various conditions should be transferred to the code input decks, in
particular for the conservative specification of initial and boundary conditions.
      More detailed suggestions for analysis of different initiating events are
described in Sections 5–18. These suggestions are formulated for groups of
events with similar phenomena occurring during the course of an event. The
level of detail is chosen in such a way as to avoid entering into features specific
to individual plants. For each of the groups, initiating events and their safety
aspects are identified and specific suggestions for analysis are formulated.
      Section 19 provides a list of the calculated parameters to be reported that
are specific to the different accident scenarios.


      According to their frequency of occurrence [3], initiating events can
either be considered as AOOs, also called transients (Ts), or accidents (As).
Accidents can be further subdivided into DBAs, BDBAs and SAs. The
methodology of analysis for various events differs mainly in the use of
diverging acceptance criteria and also in the level of conservatism in the
analysis assumptions.
      A typical categorization for groups of initiating events [3] can be
proposed, consistently with Ref. [4], as follows:

(a)   Reactivity induced accidents (RIAs):
      — Control rod (CR) ejection (A);
      — CR withdrawal (T);
      — CR malfunction (T);
      — Incorrect connection of an isolated reactor coolant system (RCS) loop,
        if applicable (A);
      — Boron dilution due to a chemical and volume control system (CVCS)
        malfunction (T);
      — Inadvertent loading of a fuel assembly into an improper position (A).
(b)   Decrease of reactor coolant flow:

      — Single or multiple reactor coolant pump (RCP) trips (T);
      — Inadvertent closure of a main isolation valve (MIV) in an RCS loop, if
         applicable (T);
      — Seizure of one RCP (A);
      — Shaft break for one RCP (A);
      — Coolant flow blockage in the fuel assembly.
(c)   Increase of reactor coolant inventory:
      — Inadvertent actuation of the emergency core cooling system (ECCS)
      — Malfunction of CVCS leading to reactor coolant inventory increase
(d)   Increase of heat removal by the secondary side:
      — Steam line breaks (A);
      — Inadvertent opening of steam relief valves (T);
      — Secondary pressure control malfunction with increase of steam flow
         rate (T);
      — Feedwater system malfunction leading to increase of heat removal (T).
(e)   Decrease of heat removal by the secondary side:
      — Feedwater line break (A);
      — Feedwater pump trips (T);
      — Reduction of the steam flow from the steam generator (SG) (T).
(f)   Decrease of reactor coolant inventory:
      — Inadvertent opening of the primary system isolating valves (A);
      — Spectrum of postulated pipe breaks — loss of coolant accidents
         (LOCAs) (A);
      — Leaks from the primary to the secondary side of the SG (A);
(g)   Anticipated transients without SCRAM (ATWS).

      During the course of a transient or an accident, a number of different
effects may challenge the integrity of the barriers against uncontrolled release
of radioactivity, by affecting the three fundamental safety functions (control of
reactivity, removal of heat from the fuel and confinement of radioactive
materials). These effects are also called ‘safety aspects’ of the accident. Some
potential safety aspects are listed below, following the sequence of the four
successive barriers, covering the full spectrum of consequences, from transients
to DBAs to SAs:

  —   Reactor power excursions due to reactivity insertion;
  —   Reactor re-criticality (local or global) after shutdown;
  —   Fuel enthalpy and temperature rise;
  —   Local fuel melting;

    — Reduction of the departure from nucleate boiling ratio (DNBR) due to
      reduced coolant flow or due to increased temperature or decreased
    — Boiling crisis due to loss of coolant inventory;
    — Overheating of fuel cladding;
    — Zirconium–water reaction of the cladding;
    — Deformation of and/or damage to the fuel cladding;
    — Hydrogen production;
    — Major fuel melting and core degradation;
    — Primary or secondary system pressurization;
    — Pressure waves formed inside the reactor system acting on reactor
    — Pressurized thermal shock;
    — Reactor vessel melt-through;
    — Mechanical impact of the escaping coolant jet and the corresponding
      reaction forces on plant components and systems;
    — Environmental impact of the escaping coolant on system and component
      qualification requirements (humidity, temperature and radiation);
    — Direct coolant radioactivity releases due to containment bypass;
    — Containment pressurization;
    — Radioactivity releases from the containment;
    — Containment basemat melt-through.

      Any initiating event may be analysed with respect to these safety aspects.
Acceptance criteria, as discussed in Section 3, are basically related to these
safety aspects. More details on safety aspects are also provided in Sections
      As already discussed in the first Safety Report in this series, Ref. [3],
different safety aspects may be related to a single internal initiating event. For
example, various LOCAs lead to the degradation of core cooling and possibly
to fuel overheating. At the same time, LOCAs lead to containment pressure
buildup, radioactivity transport and possibly environmental releases. Under
certain conditions, safety injection may cause a significant temperature
reduction in the downcomer region of the reactor vessel, thus leading to a
potential pressurized thermal shock (PTS). The boiling condensing regime
during a LOCA may result in boron dilution by creating a slug of coolant of low
boron concentration in the primary circuit. Such a case would have the
potential for a reactivity accident. In some countries, complete failure of
reactor scram in the case of LOCAs is required to be studied as an ATWS
sequence. For primary to secondary leakage accidents, which are a special case
of LOCAs, radioactive fission products can be directly transported to the

environment through the secondary side steam relief paths, thus leading to a
containment bypass. Each of these safety aspects requires different
assumptions for the analysis, at least a partially different methodology and
often even a different computer code.
      For practical reasons, safety aspects and dominant phenomena are used as
a basis to group the suggestions about methodologies in this report.
Consequently, for each group it is possible to use the same computer code, to
select similar acceptance criteria and/or similar initial conditions, applying
similar methodologies with the results being presented in similar form.
      The groups selected for this guidance are as follows:

  — Analysis of core cooling and system pressure for various events;
  — Analysis for core cooling for LOCAs;
  — Analysis of containment bypass due to primary to secondary side leakage
  — Analysis of ATWS;
  — Analysis of boron dilution;
  — Analysis of PTS;
  — Analysis of residual heat removal (RHR) degradation during shutdown
    operational modes;
  — Analysis of pressure–temperature transients in containments;
  — Analysis of radioactivity transport during DBAs;
  — Analysis of SAs; in the present report, only very short guidance is
    provided since separate guidance documents will be issued by the IAEA
    for SAs.

      For each group of events listed above, a more detailed list of initiating
events is given in Sections 5–18 with their direct causes, categorized according
to their frequency of occurrence. Safety aspects of the event leading to a
potential degradation of barriers are summarized, and suggestions on the
selection of acceptance criteria as well as of initial conditions are provided.
Finally, some specific methodological instructions on how to perform the
analysis of individual events are provided.
      Some suggestions, in particular the conservative selection of initial and
other conditions for accident analysis, are mainly applicable to conservative
analysis, which is typical for design or licensing analysis. The majority of the
other suggestions is also applicable to best estimate analysis.
      It is emphasized that most of the information given in this report is meant
as examples of good practices, based on experience from several countries. The
guidance may not automatically apply to all the individual reactor designs,
computer codes and selected approaches used in accident analysis.

                     3. ACCEPTANCE CRITERIA

      The applicable acceptance criteria used in accident analysis typically
depend on the objective of the analysis (e.g. design or licensing), on the
frequency of the initiating events, on the related safety aspects and on the
existing high level limits for accident consequences. Thus, different criteria exist
for AOOs, for DBAs and for BDBAs or SAs. Acceptance criteria for accidents
are further differentiated for LOCAs, for ATWS and for other types of
accident. Typical examples of acceptance criteria are given below.


       For transients it has to be demonstrated that the intrinsic features of the
design and the systems automatically actuated by the instrumentation, particu-
larly the reactor trip system, are sufficiently effective to ensure that:

(1)   The probability of a boiling crisis anywhere in the core is low. This crite-
      rion is typically expressed by the requirement that there is a 95% proba-
      bility at the 95% confidence level that the fuel rod does not experience a
      departure from nucleate boiling (DNB). The DNB correlation used in the
      analysis needs to be based on experimental data that are relevant to the
      particular core cooling conditions and fuel design.
(2)   The pressure in the reactor coolant and main steam systems is maintained
      below a prescribed value (typically 110% of the design pressure).
(3)   There is no fuel melting anywhere in the core.


      For DBAs it has to be demonstrated that the design specific engineered
safety features are sufficiently effective to ensure that:

(4)   The radially averaged fuel pellet enthalpy does not exceed the prescribed
      values (the values differ significantly among different reactor designs and
      depend also on fuel burnup) at any axial location of any fuel rod. This cri-
      terion ensures that fuel integrity is maintained and energetic fuel disper-
      sion into the coolant will not occur (specific to RIAs).
(5)   The fuel rod cladding temperature does not exceed a prescribed value
      (typically 1480°C). This criterion ensures that melting and embrittlement
      of the cladding are avoided.

(6)    Fuel melting at any axial location of any fuel rod is limited (typically, no
       fuel melt is allowed or a maximum 10% melt of the fuel volume at the hot
       spot is accepted). This criterion ensures that substantial volumetric
       changes of fuel and a release of radioactive elements will not occur.
(7)    The pressure in the reactor coolant and in the main steam system is main-
       tained below a prescribed value (typically 135% of the design value for
       ATWSs and 110% for other DBAs). This criterion ensures that the struc-
       tural integrity of the reactor coolant boundary is maintained.
(8)    Calculated doses are below the limits for DBAs, assuming an event gen-
       erated iodine spike and an equilibrium iodine concentration for contin-
       ued power operation, and considering actual operational limits and con-
       ditions for the primary and secondary coolant activity.

      In addition to criteria (4)–(8), particularly for design basis LOCAs, short
term and long term core coolability should be ensured by fulfilling the
following five criteria:

(9)    The fuel rod cladding temperature should not exceed a prescribed value
       (typically 1200°C); the value is limiting from the point of view of cladding
       integrity following its quenching and is also important for avoiding a
       strong cladding–steam reaction, thus replacing criterion (5) which is valid
       for other accidents.
(10)   The maximum local cladding oxidation should not exceed a prescribed
       value (typically 17–18% of the initial cladding thickness before oxida-
(11)   The total amount of hydrogen generated from the chemical reaction of
       the cladding with water or steam should not exceed a prescribed value
       (typically 1% of the hypothetical amount that would be generated if all
       the cladding in the core were to react).
(12)   Calculated changes in core geometry have to be limited in such a way that
       the core remains amenable to long term cooling, and the CRs need to
       remain movable.
(13)   There should be sufficient coolant inventory for long term cooling.


     In addition to the relevant criteria given above, the following criteria

(14) The calculated peak containment pressure needs to be lower than the
     containment design pressure and the calculated minimum containment
     pressure needs to be higher than the corresponding acceptable value.
(15) Differential pressures, acting on containment internal structures
     important for containment integrity, have to be maintained at acceptable


     Specific acceptance criteria for PTS analysis should apply, as follows:

(16) There will be no initiation of a brittle fracture or ductile failure from a
     postulated defect of the reactor pressure vessel (RPV) during the plant
     design life for the whole set of anticipated transients and postulated acci-


      The operational modes considered have several barriers partially
degraded (reactor pressure vessel closed or open, containment closed or open).
Besides generally applicable criteria, such as (8), the following specific (more
stringent in the case of degraded barriers) criteria have to apply:

(17) If both the reactor and the containment are closed, the fuel cladding tem-
     perature and oxidation have to be limited to the same values as those for
     a LOCA.
(18) If one of the barriers (either reactor or containment) is open while the
     other is closed, uncovery of the fuel in the reactor needs to be avoided.
(19) If both barriers (reactor and containment) are open, both coolant boiling
     in the core and fuel uncovery need to be avoided.


     Acceptance criteria for SAs are less prescriptive than the criteria for
DBAs. Typically, the criterion is considered in relation to the very low
probability associated with an SA.

     Examples of more specific criteria applicable for SAs with non-negligible
probability are as follows:

(20) There should be no failure of the containment because of pressure and
     temperature loads.
(21) There should be no immediate health effects on the population.
(22) For long term effects the 137Cs release limit needs to be below the pre-
     scribed value (e.g. 100 TBq), and all the other nuclides together are not to
     cause a larger danger after the time period specified (e.g. three months).

                   4. SELECTION OF INITIAL

      There are a number of input parameters for analysis, corresponding to the
NPP status prior to the accident, which have a major influence on the results;
they are often called key parameters. Among them, plant initial conditions and
possible bounding values for some process variables play an important role.
Initial and boundary conditions have to be selected, either realistically or
conservatively (depending on the approach selected), from a range depending
on the plant operational mode and on the parameter uncertainties. These
uncertainties include technically acceptable tolerances, calculation uncer-
tainties or measurement inaccuracies.
      A typical set of initial conditions, to be specified for thermohydraulic and
neutronic calculations, is shown in Table I. For each parameter, the conservative
direction (maximum/minimum) is indicated for two basic types of analysis: for
conservative analysis of core cooling (leading to a low value of the DNBR) and
for conservative analysis of pressure in the primary system (leading to a high
value of the system pressure).
      The results of an analysis depend also on the neutronic characteristics of
the core, which determine the reactor power behaviour during the course of
accidents. The conservative approach typically aims to overestimate the reactor
thermal power, which is strongly dependent on reactivity feedback coefficients
and on the change of core parameters. Reactivity feedback depends on the
direction of the change (increase or decrease) of the parameter under consid-
eration. The direction may change during the course of the accident, and
therefore the influence of feedback coefficients may also vary during the
      A conservative selection of the reactivity feedback coefficients for a
typical change of parameters is shown in Table II. For more complicated


                                                    Conservative direction
                                             Core cooling           System pressure

Reactor power                                   Max.                       Max.
Reactor residual heat                           Max.                       Max.
Reactor coolant flow                             Min.                       Min.
Reactor core bypass                             Max.                        Min.
Reactor coolant temperature                     Max.                        Min.
Reactor coolant pressure                         Min.a                     Max.
Steam generator level                            Min.                       Min.
Steam pressure                                  Max.                       Max.
Feedwater flow                              N/A (consistent            N/A (consistent
                                             with power)                with power)
Pressurizer level                                Min.                      Max.
Power peaking factor                            Max.                       Max.
CR worth available for reactor scram             Min.                       Min.

a For LOCA analysis, a maximum value should be selected. For ATWS and SA analysis,
best estimate plant initial conditions are typically acceptable, even for design and licens-
ing type analyses.

processes it is suggested that parametric analyses to evaluate the influence of
the coefficients be performed. In selecting the coefficients, there should be,
however, no intermixing of values belonging to different operational states
(beginning of fuel cycle (BOC); end of fuel cycle (EOC)).
      In Table II, ‘weak’ means minimum absolute value of a feedback
coefficient and ‘strong’ means maximum absolute value of a feedback
coefficient. Table II is only illustrative. The selected parameters need to be
checked carefully for their influence on the results of the analysis, case by case
before each application.
      A significant influence on reactor power comes also from the
assumptions associated with scram reactivity. The negative reactivity insertion
following a reactor trip is a time function of the rod position itself and of the
variation in rod worth with position in the core. For accident analysis, the key
parameter is typically the time of insertion up to ‘dashpot entry’ (around 85%
of CR assembly travel). The selected value needs to be conservatively higher
than the measured values for any of the fuel loadings. Conservative values also
have to be selected for the integral value for scram reactivity.


                                  Reactivity feedback
                           Fuel                      Boron      Fraction    Prompt
Parameter change                                               of delayed   neutron
                       temperature      MTC a    concentration
                                                                neutrons    lifetime
                        coefficient     + void     coefficient
                          (FTC)                      (BCC)
Increase of coolant
                         Strong         Weak            Weak     Max.        Max.
Decrease of coolant
                          Weak          Strong          Weak     Min.        Min.
Reactivity increase
                          Weak          Weak            Weak     Min.        Min.
by CRs
Reactivity decrease
                         Strong         Strong          Weak     Max.        Max.
by CRs
Void fraction in the
                         Strong         Weak            Strong   Max.        Max.
core during LOCA
Boron dilution            Weak          Weak            Strong   Min.        Min.

a   MTC: moderator temperature coefficient.

      For containment pressure–temperature analysis, the basic initial
conditions of the containment atmosphere are shown in Table III. The conser-
vative selection of parameters, leading to an overestimation of the maximum
containment pressure, is also shown.
      Other boundary conditions that affect reactor power are the various
instrumentation processing time delays associated with each trip function.
These time delays typically include delays in signal actuation, in opening the
trip breakers and in the release of the rods by the magnetic mechanisms.
Accident analysis needs to assume conservative values for the total time delay
from reaching the trip conditions up to the beginning of rod insertion.
      For a conservative PTS calculation from the point of view of the RPV,
conditions maximizing pressurization of the RCS and cooling down of the
downcomer region have to be selected, and the selection of RPV material
properties also has to be done conservatively. Conservative RPV material
properties need to maximize the defect size in the RPV that is non-detectable
by non-destructive testing (NDT), maximize the material brittle fracture
temperature and minimize the reactor material fracture toughness.
      For conservative radioactivity transport calculations, radioactivity
accumulated in the primary coolant as well as radioactivity contained/released


             Parameter                            Conservative selection
             Containment initial pressure                 Max.
             Containment initial temperature              Min.
             Spray water temperature                      Max.
             Containment leak rate                        Min.

from the fuel rods has to be maximized. For primary to secondary leakage
(PRISE) accidents, the leakage from the primary to the secondary system has
to be maximized.



5.1.1.     Initiating events and safety aspects

      An RIA may be initiated by the loss of integrity of the CR drive housing
with rapid expulsion of a control assembly from the core due to the differential
pressure between primary coolant and the containment. This event leads to a
rapid reactivity insertion, causing an RIA, and to a small break LOCA (SB-
LOCA) at the same time.
      Safety aspects leading to the challenging of acceptance criteria are as

(a)      Rapid reactor power increase resulting in a fuel temperature rise and in
         a reduction of DNBR; hence a reduction of heat removal and potential
         for consequential fuel rod damage and radioactivity release.
(b)      Primary coolant pressure increase as a consequence of the power increase
         as well as of a turbine trip. This depends on the actual break size, on
         whether the pressure increase will in fact occur and also on whether
         there will be a need for actuation of the ECCS due to a loss of primary

(c)      Containment pressure and differential pressures increase, leading to pres-
         sure loading of the containment walls; owing to the smaller break size, this
         aspect is usually much less important.
(d)      Radiological consequences due to a loss of primary coolant, potentially
         also due to a loss of cladding integrity or fuel disintegration.

      The suggestions provided in the following are relevant for the first safety
aspect mentioned above; other aspects need to be considered separately
(Sections 10, 16 and 17). Relevant acceptance criteria are Nos (4)–(8) in
Section 3.

5.1.2.     Specific suggestions for analysis

      Several cases need to be considered in the analysis. These include BOC
and EOC, hot full power (HFP) and hot zero power (HZP), as well as inter-
mediate power levels. The BOC case is the minimum feedback case since it
typically has the least negative moderator temperature coefficient (MTC). The
EOC case has a slightly smaller Doppler coefficient but a much larger
moderator feedback effect. This causes the EOC transient to be less severe
than the BOC transient for the same reactivity excursion (measured in US
dollars). However, for EOC the reactivity in US dollars may be larger due to
the reduction of the fraction of delayed neutrons with increasing core lifetime.
Both these cases therefore have to be analysed to sufficiently cover the range
of expected conditions. Sometimes intermediate stages between BOC and
EOC have also to be considered to ensure conservatism of results.
      For the purpose of the analysis, the accident may be simulated by linearly
introducing reactivity up to the ejected rod worth within a sufficiently short
time span (e.g. 0.1 s). This linear reactivity addition is a calculation convenience
rather than an attempt to simulate the actual ejection of a rod. Such an
assumption is acceptable since the 0.1 s ejection time is rapid enough compared
with the non-linear feedback effects, so that the calculation is not sensitive to
the expected S shape of the reactivity versus distance curve.
      The value of the reactivity to be inserted during the accident is to be
found by means of three dimensional (3-D) steady state neutronics calculations
that incorporate all possible reactor states and all possible CR positions
allowed by the operational limits and conditions of the NPP.
      It is also preferable that a transient 3-D neutronic analysis be performed.
Optionally, a combination of a 3-D steady state power distribution analysis with
a transient point kinetics calculation of the total reactor power is acceptable.
For the latter case, the steady state power distribution has to be calculated at
least for two operational states: for the initial reactor state before the accident

and for the state after CR ejection (at the same power level). For the transient
analysis with a fixed power distribution, the distribution with a higher peaking
factor needs to be chosen. The neutron flux power peaking factor can
optionally be linearly increased from its initial steady state value to the final
value within the time for the rod to be ejected.
      Core inlet coolant temperature, core flow and coolant pressure may be kept
constant for the analysis of the reactor power increase due to the fact that changes
of these parameters are not substantial during the short time interval analysed.
      Conservative values of reactor trip reactivity (conservative time delay
and reactivity versus CR position dependence) are used, typically assuming a
stuck CR in addition to the ejected rod. The stuck rod selected is the highest
worth rod at HZP with all rods inserted except the ejected rod, and will usually
be a rod adjacent to the ejected rod. This assumption is made to account for the
possibility of the ejected rod causing damage to an adjacent rod drive housing
and preventing that rod from tripping.
      A weighting factor is applied to the calculated Doppler feedback to
account for the expected increase in feedback as a result of the skewed power
distribution after the CR has been ejected. The Doppler weighting has to be
conservatively calculated.
      In applying the single failure criterion, considering that the first signal to
actuate the reactor trip system has to come from an excessive increase rate of
the neutron flux, a potential failure in a reactor power measurement channel
also needs to be taken into consideration.


5.2.1.   Initiating events and safety aspects

      For analysis of CR withdrawal, the uncontrolled withdrawal of a bank of
CRs either at subcritical/zero power conditions or at full power is considered.
The accident is caused either by a control system failure or by an erroneous
operator action.
      Control rod withdrawal results in a power excursion accident with a
reduction in DNBR. The core thermal limit, i.e. the DNB, can be exceeded. The
power excursion is limited by temperature feedback effects and/or by reactor
trip. The excursion also leads to an increase in both the primary and the
secondary system pressure. Owing to the fact that CRs are withdrawn at the
normal operational velocity, the reactivity insertion rate, and consequently
the power excursion, is significantly slower than in the rod ejection case.
      Relevant acceptance criteria are Nos (1)–(3) in Section 3.

5.2.2.     Specific suggestions for analysis

      Both zero power and full power conditions have to be considered to
verify the effectiveness of feedback effects and the reactor trip system in
limiting the power excursion. Other initial conditions will be selected similarly,
as for the CR ejection accident.
      The maximum reactivity insertion rate may be calculated by a 1-D or a
3-D code. Other conditions are the same as for a CR ejection accident. For a
conservative calculation, conservative values of the time when reactor trip
occurs (from which parameter the reactor scram is activated) and of the
reactivity of withdrawn CRs have to be used.
      Selection of a single failure criterion needs to be made depending on the
acceptance criterion considered. For example, a failure in the pressurizer relief
valve, which is conservative for the primary system pressurization, is not
necessarily conservative from the point of view of minimum DNBR.


5.3.1.     Initiating events and safety aspects

         Three possible events are typically considered in this group:

  — Drop of one CR,
  — Withdrawal of one CR,
  — Misalignment of one CR.

      As a consequence of any of these events, there is a distortion in the core
power distribution with potential reduction of DNBR. For a CR withdrawal,
there is also a global reactor power increase, which is reduced later by the
reactor power control.
      A potentially relevant safety aspect comes from the case when a rod
drops into the core and the CR system is in automatic mode. In this case, the
rods will be moved out to compensate for the sudden power decrease. Before
achieving a new equilibrium power, a transient overshoot on nuclear power can
be expected, coincident with a significant distortion in radial power distribution
caused by the dropped rod. High local peaking factors together with an
overshoot in power may violate the limits on fuel power density.
      Applicable criteria for these events are Nos (1)–(3) in Section 3, since
those cases are categorized as AOOs. Optionally, a withdrawal of one CR can
be also categorized as an accident, with relevant acceptance criteria to be used.

5.3.2.   Specific suggestions for analysis

       A dropped CR or withdrawal of one CR has to be analysed as a transient
problem. Misalignment of a CR can be analysed as a steady state problem. A
change in core power distribution during an accident needs to be adequately
dealt with (see Section 5.1.2 for the case of ejection of one CR).
       For the dropped rod case, a sensitivity study has to be performed to
search for different possible combinations of rods that drop and various single
failures in reactor trip actuation. A 3-D neutronic calculation has to be
performed to estimate the effect on the ex-core neutron detectors used to
actuate the reactor trip system, or a conservative approach needs to consider
the case in which no reactor trip is directly caused by the rate of change in
neutron flux. These cases will maximize the combined effect of local flux
distortion and total nuclear power. Additionally, for transient cases with the
control system in automatic mode, adequate modelling of such a system has to
be considered.
       Loss of off-site power is usually not considered in combination with this
initiating event.


5.4.1.   Initiating events and safety aspects

      Such an event is typical, although not exclusively, of WWER-440 reactors
with an MIV installed in both the hot and cold legs of all circulation loops. The
reactor, in accordance with operational limits and conditions, may be in
operation at reduced power, with one of the loops isolated by an MIV. Coolant
temperature and boron concentration can be reduced in the isolated loop. The
reduced values are limited by the plant operational limits and conditions.
      The event may be initiated by:

  — Startup of the main circulation pump (MCP) in an isolated loop, followed
    by opening of MIVs;
  — Startup of the MCPs in an inoperable non-isolated loop, either not
    equipped with an MIV or with the MIV remaining in the open position;
  — Inadvertent opening of an MIV.

     Both causes result from an erroneous operator action. The accident is
developing into an RIA due to feedback through the MTC, either due to lower

core inlet temperature or due to higher core mass flow rate. Consequently,
reactivity insertion leads to a power excursion and a reduction in DNBR.
      The event is classified as an accident and therefore acceptance criteria
Nos (4)–(7) apply, although a DNB (applicable for an AOO) can usually be
avoided. Criterion No. (7) (maximum primary pressure) is not challenged in
this case.

5.4.2.   Specific suggestions for analysis

      The course of the accident is mostly influenced by the MTC. For conser-
vative evaluation, the highest possible negative value of the MTC has to be
selected, which is typical for the EOC. At the same time, weak fuel temperature
feedback needs to be considered. The high power peaking factor is another key
parameter for the analysis.
      As the accident may lead to an asymmetry in the core power distribution,
coolant mixing in the lower reactor plenum needs to be based either on
experiments or on operational data. Low coolant mixing in the downcomer and
in the lower plenum is a conservative assumption. Adequate consideration of
timing for the MIV opening and MCP startup has to be made in connection
with mixing and the time development of the process. If mixing is not proven
to be sufficient at the core inlet, the 3-D core neutron kinetics model and the
3-D thermohydraulic model are suggested for the analysis.
      Selection of initial parameters, such as reactor power, coolant
temperature, number of operating loops and boron concentration in the
isolated loop, has to be made in accordance with plant operational limits and
      It is acceptable not to consider loss of off-site power for the analysis. A
single failure needs to be typically considered in the systems influencing the
core power limitation.


      Boron dilution events are featured by an inadvertent decrease of the
boron concentration in the primary coolant.
      Homogeneous dilution may occur due to CVCS malfunction when
operation of primary pumps or natural circulation of coolant is sufficient for
uniform mixing in the whole primary circuit. The process is slow and the
operator usually has enough time to take corrective measures. Homogeneous
dilution is usually classified as an AOO.

      Inhomogeneous or local boron dilution takes place if a slug of non-
borated water or water with low boron concentration is formed in the primary
loop. There is a potential for rapid core power increase if the slug is transported
without sufficient mixing to the reactor core, due to pump startup or for
example to re-establishment of natural circulation. The slug could be formed by
non-borated water injection by the CVCS to stagnant loops or due to leakages
into the primary system from other systems. These sequences are called
external dilution cases and they are classified as accidents.
      During accidents with decreased reactor coolant inventory, such as SB-
LOCA, PRISE and ATWS, there is a possibility for an inherent dilution when
the reactor enters into boiling–condensing mode. During this mode, the steam
produced in the core condenses in the SGs and the non-borated condensed
water is collected in the loop seal, forming a diluted water slug. Inherent
dilution is one of the safety aspects to be analysed during the corresponding
accidents. These aspects are further discussed in Section 13.


5.6.1.   Initiating events and safety aspects

      Such a situation may be caused by inadvertent loading of one or more
fresh fuel assemblies into an improper position or incorrect assembly rotation
in the core due to human error during the core reloading procedure. The core
power distribution can be consequently distorted, leading to high power
peaking factors with potential violation of the core thermal limits, which means
      The event is classified as an accident and acceptance criteria Nos (4)–(7)
should apply. Criterion No. (7) (high primary pressure) is not particularly

5.6.2.   Specific suggestions for analysis

      The analysis needs to be performed for BOC conditions, corresponding to
the HFP state of the reactor. A combination with other failures is not relevant.
Representative combinations of core loading mistakes have to be considered,
including wrong positioning of fresh and partially burned fuel assemblies with
different burnups.
      Owing to the nature of the event, a steady state calculation is adequate
for the analysis. The analysis should prove that either distortion of the core

power distribution is detected by the in-core instrumentation or that the
change of the reactor power distribution is acceptable for long term reactor
operation (i.e. it is within acceptable values for power peaking factors).



6.1.1.   Initiating events and safety aspects

      An MCP trip due to an interruption of the power supply or failure of the
control system is the most typical cause for a reduction of primary coolant flow.
Reduction of the primary flow leads to an imbalance between the heat
produced by the fuel and the heat removed from the core, potentially
exceeding core thermal limits, which means a DNBR. Thermal imbalance also
leads to an overall pressure–temperature transient, typically resulting in a short
term pressurization of both the primary and the secondary circuit.
      MCP trips are typically categorized as anticipated operational
occurrences, therefore acceptance criteria Nos (1)–(3) of Section 3 apply.

6.1.2.   Specific suggestions for analysis

      The flow distribution between the core flow and the bypass flow needs to
be conservatively considered. Selection of an adequate DNBR correlation is
essential. A statistical analysis (validation combined with a definition of
uncertainty against experimental data) is required.
      Three dimensional effects of coolant mixing in the reactor downcomer
and the RPV lower plenum are required to be taken into account or conser-
vative assumptions have to be adopted, except for the case when all the MCPs
are tripped simultaneously. For an analysis of individual pump trips, four
quadrant pump characteristic curves are needed. A combination of the event
with loss of power supply is not required.
      The single failure criterion typically considers a failure to open either a
secondary steam bypass station or the pressurizer relief valves.

     For reactors equipped with a special power control system designed to
cope with MCP trips, consideration of this control system is acceptable.
Optionally, a failure of this system might be analysed.


6.2.1.   Initiating events and safety aspects

      Such an event is possible for reactor designs with MIVs (gate valves)
installed in circulating loops. The MIV closure time is typically several tenths of
a second, resulting in a relatively slow reduction of the core flow. The event can
be initiated by an erroneous manual operator action. Safety aspects and
applicable criteria are the same as in the case of an MCP trip.

6.2.2.   Specific suggestions for analysis

     Events can be modelled by introducing an input function for the
hydraulic resistance of the MIV in the corresponding primary loop. Other
suggestions are the same as for MCP trips (Section 6.1.2).


6.3.1.   Initiating events and safety aspects

      The cause of such an event can be mechanical damage. The event itself
leads to a very sharp reduction of the flow in the corresponding loop, typically
within a time shorter than 1 s. In the case of MCP seizure, it is assumed that the
support components are designed to withstand transient mechanical loads
without the failure of primary piping.
      The event is categorized as an accident, and therefore acceptance criteria
Nos (4)–(8) apply.

6.3.2.   Specific suggestions for analysis

      The same additional suggestions are valid as provided for MCP trips
(Section 6.1.2).


6.4.1.     Initiating events and safety aspects

      Such an event is typically caused by the presence of debris in the primary
circuit following a refuelling/maintenance period. They lead to total or partial
coolant flow reduction and sudden disproportion between heat generation in
the fuel assembly and heat removal from the fuel assembly. Owing to these
facts the local coolant temperature increases, the cladding temperature also
increases and, consequently, the DNBR decreases. This two phase flow typically
takes place in the fuel assembly. However, the impact on the overall plant
behaviour can still be insignificant.
      The event is categorized as an accident, and therefore acceptance criteria
Nos (4)–(8) apply.

6.4.2.     Specific suggestions for analysis

     A subchannel or 3-D thermohydraulic computer code is required for this
analysis. Parameters in the lower plenum and the upper plenum of the reactor
can be specified as boundary conditions for detailed core analysis.



7.1.1.     Initiating events and safety aspects

     Such an event can be initiated either by control system malfunction or by
operator error, often during testing of the ECCS.
     The safety aspects of the event are as follows:

(a)      There is a pressurization of the primary system due to an increase of the
         coolant inventory.
(b)      Emergency injection of cold coolant may lead to non-symmetrical reduc-
         tion of the coolant temperature at the RPV inlet, potentially affecting
         vessel integrity.

(c)      In the case of overfilling of the pressurizer, the accident could lead to the
         pressurizer safety valve becoming stuck in the open position and a LOCA
(d)      In the case of loss of integrity of the pressurizer relief tank, containment
         pressurization will take place.

     For aspect (a), which is mainly considered in this section, the applicable
acceptance criterion is No. (2) (Section 3). Aspect (b) needs to be analysed by
the methodology for PTS (Section 14). Aspect (c) has to be analysed in
accordance with Section 10 and aspect (d) in accordance with Section 16.

7.1.2.     Specific suggestions for analysis

      Application of a single failure criterion has to take a failure in the
pressurizer relief (safety) valves into consideration. The integrity of the
pressurizer relief tank also needs to be analysed. Such events are typically not
combined with a loss of off-site power. The maximum capacity of the ECCS has
to be used as a conservative assumption in the analysis.


7.2.1.     Initiating events and safety aspects

      The event may be initiated by a failure in the control system of the CVCS,
which leads to an increase of the reactor coolant inventory. Safety aspects are
the same as for the startup of the ECCS. Moreover, there is a potential for
injecting non-borated water, which would cause an RIA (Sections 5 and 13).
For other aspects, the relevant acceptance criterion is No. (2) in Section 3.

7.2.2.     Specific suggestions for analysis

      The same suggestions as provided for the actuation of the ECCS apply
(Section 7.1.2).



8.1.1.     Initiating events and safety aspects

      Such accidents can be initiated by a partial or full steam line rupture,
which may occur either inside or outside the containment. The limiting size for
a break (typically located outside the containment) is rupture of the main
steam header (if relevant) up to its full size break.
      The accident leads simultaneously to depressurization (cooling down) of
the secondary circuit and loss of the secondary coolant, leading also to
overcooling of the RCS. Typically, the effect of cooling down dominates, leading
to a non-symmetrical cooling of the RPV wall, to a positive reactivity insertion,
to a potential recriticality and to a reactor power increase in some situations
regardless of scram.
      Safety aspects of this accident, with possible violation of acceptance
criteria, are as follows:

(a)      Possible reactor power increase or reactor recriticality after its shutdown
         due to a substantial decrease of the core inlet temperature, typically in
         one section of the core adjacent to the affected loop. In the case of a coin-
         cident loss of power supply (MCP coastdown), the DNBR is reduced and
         a boiling crisis can occur in the reactor core.
(b)      Loss of secondary coolant due to steam outflow; this is usually less signif-
         icant than the cooling effect of depressurization.
(c)      Significant and rapid non-symmetrical reduction of coolant temperature
         at the RPV inlet followed by high pressure emergency coolant injection,
         potentially affecting the vessel integrity.
(d)      Containment pressure and sub-compartment differential pressure
         increase, leading to pressure loading of the containment structure (in the
         case of a break inside the containment).
(e)      Containment temperature loading (usually higher than during primary
         circuit LOCAs).
(f)      Loss of secondary coolant can lead to SG tube bundle uncovery, primary
         circuit temperature increase and high pressure injection system (HPIS)
         activation. This situation can lead to an increase of primary pressure, fill-
         ing of the pressurizer and overpressurization of the primary circuit.

       Aspects (b)–(e) above have to be analysed by a special methodology
(Sections 9, 14 and 16). Therefore, the rest of this section is applicable only to
aspects (a) and (f). Such events belong to the category of accidents, and
therefore acceptance criteria Nos (4)–(8) in Section 3 apply. For some designs
it is, however, possible to comply even with the more stringent criteria,
Nos (1)–(3), for this type of accident.

8.1.2.   Specific suggestions for analysis

      Typically, the analysis needs to be performed for both HFP and HZP
operational states, with and without MCPs running. Reactivity feedback coeffi-
cients (in absolute values) are to be selected for the EOC with the aim of
maximizing the possibility of returning to criticality.
      The break location and flow model for steam release have to be selected
in such a way that the break outflow is maximized. Consideration of the flow
measuring nozzles and valves installed in the steam lines is, however, important
for the calculation of the break outflow. The most severe case for a steam line
break is typically a break upstream of the main steam isolation valve (MSIV).
Breaks downstream of the MSIV will be stopped when the valve closes (if not
      It should be considered that at the reactor trip the most effective CR was
stuck in its upper position. It has to be assumed that the stuck rod is located in
the cold section of the reactor core adjacent to the affected loop.
      The influence of HPIS needs to be analysed parametrically with respect to
the cooldown rate and the change in primary circuit boron concentration.
Different numbers of ECCS pumps, pump characteristics and possible non-
uniform injection into individual main coolant loops have to be considered in this
      In the case of a recriticality, in particular when a point kinetics model is
used, maximum power peaking factors possibly occurring during the whole
process have to be considered for the DNBR calculations. Xenon decay after
reactor scram may be neglected for processes with durations of several
minutes. Boron addition is allowed to be considered during the accident, but its
time delay needs to be considered conservatively high and its mixing has to be
considered conservatively low.
      DNBR calculations should be performed by a subchannel approach. For
simplicity, steady state calculations are acceptable at time points chosen conser-
vatively along the transient.
      Specific requirements for the computer code to be used are as follows:

(a)      A complex computer code capable of adequately simulating the behav-
         iour of both the primary and secondary systems as well as neutron kine-
         tics is needed.
(b)      A 3-D dynamic neutronics model is preferred. If this is not available, it is
         necessary to combine a conservative 3-D steady state neutronics model
         with a 1-D thermohydraulics model for integral calculations.
(c)      A model of non-ideal coolant mixing in the reactor plenum is preferred.
         If such a model is not available, conservative assumptions on coolant mix-
         ing need to be used.
(d)      The code used has to be able to consider water carry-over by steam flow-
         ing out of the secondary circuit; otherwise, a conservative approach is to
         be chosen to maximize the loss of secondary coolant, also considering,
         however, the next requirement.
(e)      The SG secondary side mixture level has either to be calculated by the
         best estimate approach, or a conservative approach needs to be taken to
         maximize the cooldown rate.

     For the single failure criterion, the following failures are typically

  — CR stuck in the upper position;
  — Failure of one of the steam leak isolating valves.

The failure of one of the steam leak isolating valves, however, may also occur
as a dependent consequential failure due to forces induced by the steam line


8.2.1.     Initiating events and safety aspects

      Such an event can be initiated by a control system failure, by an instru-
mentation failure (e.g. sensor failure) or by an operator error, leading to
inadvertent opening of or failure to close the valves, and a subsequent release
of steam from the secondary circuit (SG safety valves, steam dump to the
atmosphere or steam bypass to the condenser).
      The safety aspects of the event are similar to those for the steam line
break, except for the containment pressurization. In addition, owing to consid-
erably lower steam outflow, the change of all the parameters is slower. The

event is categorized as an AOO, therefore acceptance criteria Nos (1)–(3)
(Section 3) apply.

8.2.2.     Specific suggestions for analysis

      The suggestions made in Section 8.1.2 are generally valid for these events
as well, but less stringent requirements on the computer code may apply.
Typically, the 1-D neutronics model, ideal coolant mixing in the reactor
plenums, no special model for water-carry over by steam outflow and a conser-
vative approach for the SG mixture level model are acceptable.


      Such events are initiated by a secondary pressure controller malfunction.
Safety aspects, acceptance criteria and specific suggestions for analysis are the
same as provided for inadvertent opening of the steam relief valves (Section


8.4.1.     Initiating events and safety aspects

         Two types of event are considered:

  — Malfunctions that increase feedwater flow (a failure of a feedwater
    control valve);
  — Malfunctions that decrease feedwater temperature (a failure of a
    feedwater preheater).

      Both events lead to an increase of heat removal by the secondary side,
thus reducing primary coolant temperature and increasing the reactor power
due to reactivity feedback. Reduction of the DNBR is the main issue, and
acceptance criterion No. 1 (Section 3) applies.

8.4.2.      Specific suggestions for analysis

      The analysis needs to be performed for both HFP and HZP. The event is
typically not combined with a loss of off-site power.



9.1.1.     Initiating events and safety aspects

      Feedwater line breaks are typically caused by a material degradation of
the secondary circuit piping, leading to a partial or full rupture of a pipe in the
feedwater system. Corresponding to the break location, the feedwater supply
can be interrupted in one or several SGs. In the case of a main feedwater
header rupture, the feedwater supply will be interrupted in all SGs.
      The accident differs from steam line breaks due to the fact that the water
outflow leads to a rapid decrease of the affected SG secondary side water level.
Thus, the secondary side heat removal capability is reduced, while cooling, due
to energy outflow, is not so high.
      Safety aspects that challenge the acceptance criteria are as follows:

(a)      Reduction or loss of secondary side heat removal leads to overheating of
         the primary coolant, with its corresponding expansion and pressurization
         of the primary circuit.
(b)      For the longer term, heat removal from the core may also be threatened,
         leading to fuel rod overheating.
(c)      In the case of a long term loss of secondary side heat removal, the pres-
         surizer relief or safety valves may stay opened. The consequences would
         be similar to those for the corresponding (in size) primary circuit rupture,
         a LOCA, resulting in the release of radioactivity into the containment.
(d)      Outflow of the secondary coolant, and possibly also the primary coolant,
         leads to containment pressurization.
(e)      Injection of cold water on previously uncovered SG tubes by recovered
         feedwater pumps may threaten the structural integrity of the boundary
         between the primary and secondary circuits.

     This section deals only with the first two aspects of the accident; other
aspects are partially dealt with in Sections 10, 16 and 17. The event belongs to
the category of DBAs, therefore acceptance criteria Nos (4)–(8) (Section 3)

9.1.2.   Specific suggestions for analysis

      The position of the break has to be selected so as to maximize the loss of
secondary coolant. The secondary coolant outflow model has to maximize the
break flow. The accident is typically analysed for both cases, with and without
loss of external power supply. The single failure criterion is typically applied to
emergency feedwater pumps and pressurizer relief or safety valves.


9.2.1.   Initiating events and safety aspects

      Feedwater pump trip, typically due to an interruption in electric power
supply, leads to loss of secondary coolant inventory and, consequently, to a
reduction of secondary side heat removal. Owing to the imbalance between
heat production and its removal by the SG secondary side, the temperature
and consequently also the pressure increase in both the primary and the
secondary circuits. These are the dominant effects for such events. The margin
to the limiting value of the DNBR will also be reduced due to the temperature
rise of the reactor coolant and, for some events, also due to primary coolant
flow reduction, although a bulk boiling crisis is typically not expected in the
      Auxiliary and/or emergency feedwater pumps are used to supply water to
the SG after the normal feedwater pump trip.
      The event is categorized as an AOO; acceptance criteria Nos (1)–(3)
(Section 3) apply.

9.2.2.   Specific suggestions for analysis

      Loss of off-site power is usually not considered for this type of event.
Conservative conditions for reactivity feedback typically occur at the BOC.
      Depending on the selected acceptance criterion (short term or long term
cooling objectives), application of a single failure criterion needs to take into
account potential failures in auxiliary feedwater pumps, pressurizer relief or
safety valves, SG safety valves and steam dump stations.


9.3.1.     Initiating events and safety aspects

     Reduction of the secondary side heat removal capability can also be
caused by an increase of the SG secondary side pressure and temperature as a
consequence of steam flow reduction. The steam flow reduction and/or loss of
a heat sink may be caused by one of the following events:

  — Reduction of the steam flow extracted from the SGs due to control
    system malfunction;
  — MSIV closure;
  — Turbine trip, with corresponding admission valve closure, due to many
    different possible failures;
  — Loss of external electrical load;
  — Loss of condenser vacuum.

      The safety aspects of these events are similar to those for a feedwater
pump trip. All these events are categorized as AOOs and acceptance criteria
Nos (1)–(3) apply.
      Typically, a simultaneous complete loss of electric supply to the MCPs is
postulated, creating additional concern about the achieved minimum DNBR in
the reactor core during the transient.

9.3.2.     Specific suggestions for analysis

         All the suggestions made in Section 9.2.2 are also valid for these events.



     A LOCA is caused by loss of integrity of the primary circuit or its
associated pipes and devices. The direct cause of such an accident is a material
defect, material fatigue, an external impact (internal missiles or heavy loads) or
a device failure during the operation of the plant. Inadvertent opening of the
pressurizer valves or any other isolation valve on the primary system boundary

can also be analysed as a LOCA. The spectrum of postulated leakage sizes
within the reactor coolant pressure boundary has been divided in various ways
depending on the selection of the acceptance criteria. In this report, the
subdivision is made into two groups, namely large break LOCAs (LB-LOCAs)
and small break LOCAs (SB-LOCAs).
       LB-LOCAs mainly include a full or partial rupture of the main
circulation line, typically with break areas higher than 25% of the cross-section
of the main circulation line. Ruptures of the major pipes connected to the
primary circuit, such as the pressurizer surge line or the accumulator discharge
lines, can also be considered as LB-LOCAs. In the case of an LB-LOCA, the
loss of primary coolant cannot be compensated for by the ECCS prior to
substantial depressurization and loss of coolant inventory from the primary
       SB-LOCAs include such breaks, smaller in size in comparison with LB-
LOCAs, which cannot, however, be compensated for by the make-up system
and thus require activation of the ECCS.
       All LOCA events are classified as accidents.
       Loss of primary coolant into the secondary circuit, for example due to the
rupture of the SG tubes, requires special consideration and is discussed
separately in Section 11.
       LOCAs have various safety aspects leading to potential violation of the
acceptance criteria, as follows:

(a)   The high velocity stream of the escaping primary coolant generates jet
      forces and reaction forces (leading to pipe whip) that endanger other sys-
      tems close to the ruptured pipe and containment internals. Similarly,
      mechanical damage can be caused by the MCP rotor overspeed induced
      by a very high primary coolant flow directed to the break.
(b)   Pressure wave propagation in the primary circuit at the very initial stage
      of the accident leads to pressure differences across the reactor internals
      with large forces acting on the internals.
(c)   Loss of coolant resulting in core dry-out leads to loss of coolability of the
      core in spite of reactor shutdown; fuel rods are heated, cladding
      mechanical properties are degraded and the integrity of the cladding can
      be lost due to internal fission gas overpressure or thermally induced
(d)   Cladding ballooning and geometrical distortions of the fuel assemblies
      may endanger the long term coolability of the reactor core.
(e)   At high temperatures, the cladding material reacts with the steam in an
      exothermic reaction, with hydrogen as a by-product. This reaction repre-
      sents an additional heat source for the cladding and can cause further

      degradation of the cladding material due to oxidation, and the potential
      for hydrogen burning or explosions inside the containment.
(f)   High energy coolant outflow into the containment leads to pressurization
      of the containment.
(g)   Containment pressurization together with high radioactivity in the con-
      tainment atmosphere (due to fuel damage) leads to leakages into the
      environment with potential radiological consequences.

      This section deals mainly with safety aspect (c), and partially with aspects
(d) and (e).
      Aspects (a) and (b) require special methodologies not covered by this
report. Aspects (f) and partially (g) are dealt with in Sections 16 and 17, respec-
      As already emphasized several times, the selection of acceptance criteria
and consequently also the selection of conservative conditions differs consid-
erably depending on the safety aspect under consideration. Generally, different
calculations have to be performed for an analysis of different aspects of the
      The relevant acceptance criteria typically corresponding to the safety
aspects under consideration are Nos (6), (8) and (9–13) (Section 3).


      The break location varies along the primary circuit and the break size has
to be selected to maximize core heat-up; maximum core heat-up is usually
obtained for a break size smaller than a full size break.
      All sources of generated and stored energy in the RCS and in the
secondary side have to be adequately considered, with a realistic timing for
each of the sources. Selection of a conservative power distribution in the core
depends on the break size. For an LB-LOCA the power distribution shape is
not so important and it is mainly the power peaking factor that plays a crucial
role. For an SB-LOCA with core uncovery, the top skewed power distribution
is usually conservative, which is typical for EOC. Conservative conditions for
an SB-LOCA may be found by parametric calculations taking into account
core power shape changes and fuel element properties. All metallic structures
have to be adequately modelled to account for the accumulated heat.
      Conservatively low characteristics (low efficiency, low capacity and a long
delay before action is taken) need to be used for reactor scram, and for both
high and low pressure ECCS pumps. A sensitivity study with respect to the
hydraulic resistance of the hydro-accumulator discharge lines needs to be

performed to maximize core heat-up. The flow distribution into the parallel
core channels, particularly distribution of the ECCS coolant from the upper
plenum into the fuel channels, and the flow intake from both ends of the fuel
channel have to be considered. Three dimensional effects in the RPV, especially
in the reactor upper plenum and the downcomer, need to be adequately
modelled; the applicability of 1-D models with an appropriate (preferably
experimentally based) selection of nodalization and pressure loss coefficients is
not, however, excluded for this purpose.
      Attention has to be paid to proper modelling of the MCP characteristics
at a very high flow rate in the affected loop; the pump characteristics for the
turbine flow regime are needed.
      LOCAs are typically analysed with the assumption of loss of off-site
power. Consequently, failure of a diesel generator is a typical assumption for
the single failure to minimize safety injection. For LB-LOCAs, the loss of off-
site power is usually assumed to be coincident with the break, but for SB-
LOCAs parametric studies may be necessary to find the bounding case.
      The long term behaviour of LOCAs, such as the loop seal effect (blocking
of steam outflow by water plugs in the circulation loops), may cause
overheating of the core: such cases can be analysed with sufficiently detailed
      The tolerance of the core to the residual insulation material and other
debris in the ECCS water during recirculation needs to be studied. Possible
boron precipitation problems in the reactor during long term boiling also have
to be studied.
      Adequate selection of nodalization is crucial for the quality of the
analysis. Therefore, the nodalization needs to be carefully verified and
validated [3]. Sufficiently detailed nodalization has to be selected particularly
in the vicinity of the break. This should adequately account for removal of
ECCS water out of the break (vessel bypass). Consideration has to be given to
detailed modelling of dead ends (e.g. the reactor upper head and CR guide
tubes), mainly regarding coolant temperature stratification. These ends may act
as pressure maintaining components during the accident. For SB-LOCA
analysis, sufficiently detailed nodalization needs to be applied for loop seals
and SGs in order to adequately consider steam binding and primary to
secondary heat transfer, which strongly influence the course of accidents and
core heat-up.
      Generally, the analysis for all LOCAs has to show how a plant is brought
into a safe controlled state, for example into cold shutdown conditions.

                   SYSTEM LEAKAGE


       Primary to secondary system (PRISE) leakages are caused by a single or
multiple SG tube rupture or, in addition, for WWER designs with horizontal
SGs, by an SG collector break or an SG primary collector cover lifting off. The
accident may be initiated by fatigue failure of the SG tube wall, material defects
produced during manufacture or, as a special case, as an induced failure from
another initiating event (e.g. steam line break or injection of cold feedwater on
the hot SG tubes).
       Owing to the large number of SG tubes, the probability of SG tube
rupture is relatively high. This accident type is therefore normally considered in
the design. The likelihood of a large PRISE leakage due to a collector break
itself was not included in the original design of WWER reactors. However,
operating experience and in-service inspections have demonstrated the
potential for large SG leaks for this design.
       The safety aspects associated with a PRISE accident are as follows:

  — Direct radioactivity release to the environment, bypassing the
    containment via steam dumps and/or via the SG safety valves;
  — Reduced core cooling (short and medium term);
  — PTS of the RPV due to cooldown and subsequent re-pressurization
    following break isolation on the primary side (typical for WWER-440s);
  — Boron dilution and reactivity insertion due to reverse flow (from
    secondary to primary side) through the break;
  — Potential for an SA initiator because of long term loss of ECCS water

      The main feature of PRISE leakage is containment bypass resulting in a
direct radioactivity release to the environment and an irreversible loss of
primary coolant. The primary water becomes radioactive during reactor
operation due to the activation of corrosion products and the presence of
fission products. The water in the secondary system may also contain some
radioactive material.
      Typically, the short term core cooling during PRISE accidents is assured
even with a minimum design ECCS configuration. However, in the case of late
leak isolation, the ECCS tanks can be completely depleted and long term core
heat-up may occur.

      The safety aspects associated with PTS, boron dilution and core cooling
(LOCAs) are described in other sections (10, 13 and 14) and are therefore not
reflected here. Only the radioactivity release and long term loss of ECCS water
are considered in the following text.
      PRISE leakages are categorized as accidents. The main acceptance
criterion relevant for these events is No. (8) (Section 3). It is also required that
the ECCS water resources be sufficient to cope with the accident without early
endangerment of the core cooling, assuming maximum PRISE leakage and late
operator interventions.


      The radioactivity release to the environment depends on the following

  — Quantity of coolant released to the atmosphere;
  — Primary coolant activity;
  — Secondary coolant activity;
  — Spiking of the iodine isotopes and the noble gases;
  — Degradation of fuel rods due to high temperatures;
  — Position of the tube rupture in the broken SG and the decontamination
  — Initial power level of the plant.

     The radiological consequences of PRISE leakages are usually analysed in
two sequential steps:

(1)   System analysis using system thermohydraulic codes;
(2)   Analysis of radiological consequences using the results of the thermo-
      hydraulic calculation as boundary conditions.

      The process of radioactivity transport is closely related to the two phase
outflow of the primary coolant. Some computer codes offer the possibility to
calculate the transport of radioisotopes (including radioactive decay) in both
water and steam phases of the coolant in addition to the two phase flow
modelling. If needed for separation of the processes of radioactivity transport
and coolant transport, a conservative approach has to be used (e.g. not
considering the dilution of the active primary coolant due to ECCS injection or
the mixing of the primary coolant with the secondary coolant in the SG

       The maximum primary to secondary side leak and the maximum activity
of the primary coolant are conservative assumptions. To assume of the full
configuration of the ECCS and the make-up system may lead to a higher loss
of coolant. In addition, the loss of off-site power and the application of the
single failure criterion can make the process more severe as only limited means
are available for mitigation of the accident.
       The primary coolant activity used in the analysis needs to be estimated
according to plant operational limits and conditions. The spiking effect caused
by the increased release of water soluble products from micro-defects in the
fuel cladding into the coolant has to be considered in the estimation of the
coolant activity. This effect varies significantly and quite irregularly for the
same reactor. The spiking effect has been noticed most clearly for 131I. A typical
upper estimate for the spiking factor (SF) for iodine isotopes is SF = 100
(activity increased by a factor of 100 during transient conditions as opposed to
the iodine activity during a steady state operation). The average value during
the first half hour is typically SF = 50. The most conservative value for the
spiking factor is 500. The spiking of noble gases is comparatively small and has
a completely different time trend. The spiking factor proposed in the literature
for noble gases is SF = 10, Ref. [10].
       The possibility that secondary side SG safety valve(s) or steam dump(s)
to the atmosphere are stuck open after their actuation has to be considered, in
particular if these devices are not qualified for two phase flow. Generally, the
systems not qualified for relevant accident conditions need to be considered to
fail, particularly if such a failure leads to a worsening of the consequences
(especially failure of isolation devices to close).
       A single failure in safety systems, for example failure to close one steam
dump valve to the atmosphere or an SG safety valve in the affected SG, has to
be considered. However, if the SG safety valves are not qualified for two phase
flow or water flow operation, their failure to close under such conditions shall
be considered. The analysis is to be performed until the final safe condition of
the plant is reached, for example with the primary pressure below the set points
of the steam dumps to the atmosphere and the SG safety valves in the case of
their proper operation, or until the primary system is depressurized to
atmospheric pressure.
       In the case when the accumulator pressure is higher than the set points of
the secondary side safety relief valves, the isolation of the accumulators needs
to be considered only in the case where this is clearly stated in existing
emergency operating procedures.
       Operator interventions are essential for the termination of a PRISE leak
and mitigation of the radiological consequences. These interventions are to be
considered after a sufficient time, which is typically 30 min but in any case not

shorter than 10 min after the initiating event. It should be demonstrated that
this time is sufficient for reliable identification of the affected SG by plant
      National limits placed on releases of radioactivity, individual doses and
collective doses shall be used in the analysis.
      Final safe conditions of the plant can also be assumed after reaching
conditions for operation of the RHR system.

                 12. ANALYSIS OF ANTICIPATED


       The initiating event for ATWS is an AOO combined with a reactor scram
failure when required to actuate. It is typically assumed that the scram signal
fails or the CRs do not move for mechanical reasons. Typical initiating events
to be analysed are to be selected from a group of initiating events with higher
probability (except the probability of reactor scram) and may be summarized
as follows:

(a)   Failure of main heat sink:
      — loss of condenser vacuum;
      — closure of MSIVs;
      — turbine trip.
(b)   Increase of steam flow:
      — opening of turbine bypass valves;
      — opening of steam line safety valves.
(c)   Loss of main feedwater supply.
(d)   Loss of alternate circuit (AC) power.
(e)   Inadvertent CR withdrawal:
      — at a particular power level;
      — at subcritical or low power startup conditions.
(f)   Loss of load.

     Usually, generic studies are designed to identify which of these initiating
events are the limiting cases. Very often, loss of the main feedwater gives the
most adverse consequences.

      The safety aspects of these accidents, leading to challenging of acceptance
criteria, are as follows:

(a)   Primary coolant temperature rise as a consequence of inadequate heat
      transfer to the ultimate heat sink;
(b)   Primary coolant pressure rise as a consequence of primary coolant expan-
(c)   Possible rise of pressurizer water level to the valve nozzles, with ‘solid
      water’ being discharged to the pressurizer relief tank;
(d)   Fuel cladding temperature rise as a consequence of possible DNB;
(e)   Formation of a low boron concentration water plug in loop seals as a con-
      sequence of a possible primary coolant boiling–condensing cooling mode
      due to degradation of the primary coolant level below the hot leg eleva-
(f)   Radiological consequences due to loss of primary coolant via the pres-
      surizer safety valves in conjunction with a loss of fuel cladding integrity.

      This section deals mainly with the first four aspects of the list above. The
remaining aspects are dealt with separately (Sections 13 and 17). Acceptance
criteria Nos (4)–(8) apply for this type of accident. Of course, these criteria
apply only if ATWS are included among the DBAs. However, ATWS are
typically considered as BDBAs, which are either excluded from the analysis or,
if not, a best estimate approach is accepted for the analysis. It is therefore
suggested that detailed conditions for the analysis are agreed upon between the
analyst and the user of the results.


       The level of conservatism for this type of accident is typically subject to
specific national requirements, but usually a best estimate analysis is
acceptable. Owing to the very low probability of coincidence of the initiating
event and a reactor scram failure, it is acceptable to consider that other plant
systems, including the plant control systems, will operate in accordance with the
design requirements if they are qualified for post-accident conditions. This
specifically means that all trains of safety systems can be considered operable,
i.e. the single failure criterion may not be adopted. Loss of power is also not
considered. There are, however, other approaches which assume a similar
choice of calculation parameters and of failures in safety systems as for conser-
vative analyses of other accidents [12].

      It is acceptable to use realistic data for the Doppler reactivity and CR
effectiveness if they are derived from experiments or adequately validated
codes. It is, however, recommended to use reasonably conservative values for
other parameters including CR position, fuel temperature, hot channel peaking
factor and local linear heat rate.
      As CRs are not considered to stop the generation of fission power, the
boron injection system is an essential means for shutting down the reactor (in
addition to coolant boiling). The minimum injection flow of this system needs
to be considered. For analysis, transport of boron has to be assumed for the
liquid phase only.
      If reactor coolant pumps are stopped following the event, natural
circulation is needed, together with the boron injection system, to transport
boron into the reactor and to shut it down. The code used to analyse ATWS
events must be capable of calculating natural circulation under the corre-
sponding operating conditions. This includes both one phase and two phase
natural circulation models.
      Steam generator modelling has to be such that the heat transfer from the
primary circuit to the secondary circuit is calculated as realistically as
possible. This means that when the heat transfer tubes are uncovered as the
level drops, there is a resultant decrease in the heat transfer rate to the
secondary side.
      If the boiling–condensing cooling mode takes place during the accident as
a result of excessive loss of coolant inventory, the boron concentration
increases in the core area. However, during this phase a water plug with very
low boron concentration may be formed in the cold legs, especially for designs
with the potential for formation of loop seals. If the water plug for any reason
departs from the loop, there is a chance that it may enter the core without any
major mixing during its transport to the core and cause a recriticality of the
core. The diluted slugs formed during the boiling–condensing mode can cause
large reactivity changes. ATWS events should also be analysed taking into
account this phenomenon.
      Attention has to be paid to an adequate modelling of the pressurizer to
account for pressurization of the primary circuit, for the possibility of
completely filling the pressurizer with water and for water discharge through
the pressurizer valves.
      Preferably a 3-D reactor kinetics calculation capability, and at least a 1-D
capability, is required in most ATWS event analyses. The capability for hot
channel analysis needs to be available. A detailed nodalization needs to be
selected in particular for the core, both the reactor plenums and the SGs on
both the primary and secondary sides.



      Boron dilution events are caused by an inadvertent decrease of the boron
concentration of the primary coolant. The boron dilution process can be
homogeneous or inhomogeneous.
      Homogeneous dilution may occur due to CVCS maloperation when the
primary pumps or natural circulation are sufficient for uniform mixing of the
whole primary circuit. The process is slow and the operator usually has
sufficient time for corrective measures. It is usually classified as an AOO.
      Inhomogeneous or local dilution takes place if a slug of non-borated
water or low boron concentration water is formed in the primary loop. There is
a potential for rapid core power increase if the slug can be transported without
sufficient mixing to the reactor core by pump startup or by re-establishing
natural circulation. The slug could be formed by non-borated water injection of
CVCS into stagnant loops or through leakages from other systems. The process
of slug formation could appear during different modes of operation. These
sequences are called external dilution cases and they are classified as accidents.
      During accidents with decreased reactor coolant inventory such as SB-
LOCAs, PRISE leaks and ATWS there is a possibility for an inherent dilution
when the boiling–condensing cooling mode occurs. During this mode, the steam
produced in the core condenses in the SG and the non-borated condensate
collects in the loop seal, forming a diluted slug.
      In SB-LOCA and ATWS events the liquid level in the RPV may decrease
below the hot leg elevation. As a consequence, steam begins to flow to the SG
and condenses there. Because the steam carries practically no boron, the boron
concentration in the cold leg loop seals begins to decrease. If for some reason
this water plug with low boron concentration begins to flow towards the core
and enters there without any major mixing with the borated coolant, the event
results in a positive reactivity insertion.
      During a PRISE leakage the primary pressure during the accident may
decrease below the affected SG pressure, reversing the break flow. Water with
a low boron concentration flows from the affected SG to the primary circuit
and further to the core. The situation becomes worse if feedwater isolation has
      Generally, the course of boron dilution accidents strongly depends on:

  — The formation of a slug with reduced boron concentration;

  — Mixing of the slug with the primary coolant during its transport to the
  — Reactor power excursion due to propagation of the slug into the core.

      Inadvertent positive reactivity insertion to the core may lead to recriti-
cality and a power increase in the core. The course of such an accident is similar
to those of other types of reactivity accidents, either slow (i.e. CR withdrawal)
or rapid (i.e. CR ejection). While for slow accidents there is typically a sufficient
time margin for a timely isolation of the source of non-borated water from the
primary circuit, for rapid accidents the power increase and its consequences can
be serious, even if reactor scram occurs.
      If boron dilution occurs during the course of another initiating event (e.g.
a LOCA or ATWS) then the safety aspects of this particular event are also
      For accidents with pure water injection from an external source, the
relevant acceptance criteria may be as follows:

(a)   For inhomogeneous external boron dilution events with the MCP startup
      accelerating the slug into the core, the acceptance criterion could be that
      no recriticality of the core (after reactor scram) is allowed.
(b)   For inherent boron dilution events, where the slug is typically transport-
      ed by re-establishment of natural circulation, the acceptance criteria have
      to be combined with the acceptance criteria of the initial accident con-
      cerning the fuel heat-up.


      For a conservative analysis, the initial boron concentration and mass flow
of injected non-borated water has to be maximized, while the circulating
volume of primary coolant, as well as the estimated mixing of non-borated
water with primary coolant, has to be minimized.
      For slow processes with sufficiently high flow rates in the primary circuit,
a simplified approach with uniform coolant mixing may be used.
      For a sudden reactivity insertion the process is very complex and has still
not been fully investigated. Modelling needs to cover the following aspects of
the accident:

  — Overall system response;

  — Process of diluted boron mixing in the RPV downcomer and in the lower
    plenum, by application of a 3-D thermohydraulic computer code with
    turbulent mixing;
  — 3-D neutron kinetics;
  — Mechanical response of the fuel.

     Various aspects of the accident may be analysed in several separate steps
using different computer codes.



      PTS represents one aspect of a variety of accident scenarios, charac-
terized by overcooling of the RPV wall (typically non-uniform), occurring
under high pressure in the primary circuit. PTS results in high temperature
gradient induced stresses, threatening the integrity of the RPV wall. Conditions
could be worsened by RPV repressurization. PTS aspects have to be
considered for all accidents with ECCS cold water injection and for accidents
leading to cooldown of the downcomer, such as rapid depressurization of the
secondary circuit.
      Consequently, the following groups of initiating events need to be

  —   LOCAs, especially small and medium breaks;
  —   Stuck open pressurizer safety or relief valves;
  —   PRISE leaks;
  —   Large secondary circuit leaks;
  —   Inadvertent actuation of high pressure injection or make-up systems;
  —   Accidents resulting in cooling down of the RPV from the outside; this
      reflects flooding of the reactor cavity, for example by the ECCS or spray

      Rapid cooldown, typically non-uniform, of the RPV wall is caused by a
cold water plume in the reactor downcomer or by external flooding of the RPV.
The conditions are further worsened if the primary circuit pressure is high. The
Resulting thermal stresses in the RPV wall may potentially threaten its

      Other aspects of relevant accident scenarios, such as loss of primary or
secondary coolant inventory or of containment pressurization, are of secondary
importance from the reactor integrity point of view and they are not considered
here. The relevant acceptance criterion for PTS is No. (16) (Section 3).


      Owing to the complexity of the PTS, the compliance with criterion No.
(16) is typically analysed in the following consecutive steps:

(1)   Neutron fluence calculation for the period of the reactor operation;
(2)   System thermohydraulic calculation;
(3)   Fluid–fluid mixing calculation;
(4)   Structural analysis.

     This guidance does not deal with the neutron fluence calculation, which
requires a special methodology, usually not considered as corresponding to the
term ‘accident analysis’. Other steps of the analysis are interrelated as follows:

(a)   The system thermohydraulic calculation should provide the following
      parameters as a function of time for the RPV wall temperature and stress
      — Downcomer coolant temperature distribution;
      — Coolant to wall heat transfer coefficients in the downcomer;
      — Primary circuit pressure.
(b)   The objective of the structural analysis is to calculate the temperature and
      stress fields in the RPV and to evaluate the stress intensity factors for pos-
      tulated cracks loaded by thermohydraulic transients. The results of the
      analysis for the structure are typically as follows:
      — Temperature distribution;
      — Stress–strain distribution;
      — Loading of postulated defects in terms of stress intensity factor.

      The sources of uncertainties in the analysis are associated mainly with the
following aspects:

  — Thermohydraulic transient analysis (prediction of flow stagnation, cold
    coolant injection rate, cooldown rate and pressure behaviour);
  — Fluid temperature distribution and coolant to wall heat transfer
    coefficients distribution in the RPV downcomer;

  — Assumptions of the structural analysis model including boundary (the
    coolant temperature distribution) and initial conditions;
  — RPV material properties including fracture toughness in initial as well as
    end of life states;
  — Neutron fluence;
  — Method of calculation of the stress intensity factors;
  — Crack geometry and size with respect to NDT effectiveness;
  — Operator action.

Therefore, careful consideration needs to be given to the aspects above and
corresponding sensitivity studies have to be carried out.
      In the analysis, attention is to be paid to scenarios leading to flow
stagnation, which causes a higher cooldown rate and formation of cold plumes
in the downcomer. Reliable prediction of the flow stagnation is very
complicated but essential for a PTS analysis. Various phenomena influence the
onset of flow stagnation, such as coolant discharge, ECCS injection, SG heat
transfer and coolant mixing in the downcomer. Nodalization of SGs and of the
downcomer plays an important role in predicting the occurrence of flow
stagnation. Typically, earlier prediction of the flow stagnation represents a
conservative direction. Particularly for the time period close to the primary
flow stagnation, the existence of downcomer cold plumes, causing the
temperature and heat transfer coefficient distributions to be non-uniform and
asymmetric, should be taken into account.
      For cases with subcooled water in the whole primary circuit, modelling of
the discharge flow (selection of the critical flow model and specification of the
hydraulic resistance of the discharge tube) may have a significant effect on the
results. For conservative analysis, the ECCS injection flow rate and the
secondary system cooling capacity have to be maximized, while the ECCS
water temperature and thermal mixing of the ECCS water with primary
coolant have to be minimized.
      Modelling of the natural circulation is typically validated for the steady
state conditions during normal operation of an NPP. In many cases the
conditions during accidents differ significantly from normal operation, and the
validity of modelling needs to be carefully considered. The same consideration
also applies for the discharge flow through the safety valves, for which the
equivalent size is defined for the single phase steam outflow. For complex
accident situations with water and a two phase discharge, the flow also depends
on the model of the critical outflow applied.
      In PTS analysis, the various aspects to be analysed (overall cooldown of
the RPV and asymmetric plumes along the RPV wall) may require different
sets of conservative assumptions. The final judgment about the conservatism

may often not be made on the basis of thermohydraulic analysis alone, since
structural analysis is needed for such a judgment as well.
      Failure of the normal operating system needs only to be considered if it
leads to a more severe PTS loading.
      In addition to modelling of the internal coolant behaviour, a detailed
modelling of the coolant thermal stratification (the fluid–fluid mixing
calculation) in the primary loops is also required.
      The stresses due to internal pressure, temperature gradients (as well as
the residual stresses for both), cladding and welds have to be taken into
account. Plasticity effects should preferably be considered. Temperature
dependent material properties for base/weld materials and cladding, and
changes of the material properties due to neutron irradiation also have to be
included. For the selection of the location of the postulated surface or
subsurface cracks (including their orientation) in the limiting areas of the
vessel, consideration needs to be given to the stress level, to the material
degradation and to the results of NDT.

             15. ANALYSIS OF RESIDUAL


     The loss of RHR during shutdown operational modes can typically occur
due to:

  —   Reduced coolant inventory;
  —   Degradation of primary coolant circulation;
  —   Failures of RHR equipment;
  —   Failures of support systems.

     The main events which may cause loss of core cooling due to the
degradation of primary coolant circulation, resulting from manipulations
during shutdown modes, are the following:

  — Excessive RCS draining, for example due to erroneous opening of drain
    valves or by a malfunction of the letdown lines;

  — Erroneous nitrogen injection into the RCS from the nitrogen supply
    system or from the isolated loops through leaky MIVs (for reactors
    equipped with such a feature);
  — Primary depressurization following a rapid cooldown, leading to bubble
    formation in the RCS.

     The main events which cause loss of core cooling due to support system
and RHR equipment failure are:

  — Loss of power supply during reactor shutdown conditions, which could be
    more likely because of the reduced number of available power sources
    under such conditions;
  — Loss of component cooling water, which could lead to failures of some
    safety system components that perform the core cooling function, such as
    low pressure ECCS pumps;
  — Loss of essential service water, which leads to the loss of the heat
    exchanger cooling capability;
  — Cavitation due to failure of RHR pumps or malfunction of control valves
    and/or orifices; these events are more probable with the primary water
    level under the hot leg elevation.

       For a loss of RHR, there is a potential for heating the coolant in the core
to its boiling point. Once boiling begins, the RPV water level decreases, leading
to a possibility for uncovering the fuel assemblies. Finally, fuel damage may
occur if the situation continues. If the containment function is also degraded,
radioactivity can be released to the environment. For these types of event,
acceptance criteria Nos (8), (12), (17), (18) and (19) apply (Section 3).
       It should be noted that boiling in the primary circuit does not always lead
to a dangerous decrease of the core water level. If RCS integrity is maintained
and the SGs are available for heat removal, the core may remain covered and
the residual heat is extracted by natural circulation or in reflux condensing heat
transfer mode. If the primary circuit is open, core uncovery takes place only if
there is no automatic action or no operator action in a sufficiently short time.


     The computer codes used for system thermohydraulics have to include
special features required for adequate modelling of relevant physical
phenomena, in particular:

  — Heat transfer in the natural circulation mode.
  — Adequate modelling of SGs in the natural circulation mode.
  — Adequate modelling of heat losses from both primary and secondary
  — Proper consideration of changes in pressure loss coefficients due to
    possible changes in coolant flow directions and flow regimes.
  — Internal coolant circulation in the reactor through the fuel channel and
    core bypass.
  — Water carryover by steam at low primary system pressure.
  — Interfacial friction correlations between steam and water; these are
    supposed to be well known for high pressure states in different two phase
    flow regimes; their range of validity needs to be checked and/or extended
    to low pressure.
  — Modelling of water entrainment; it can strongly influence the time to
    uncover the core, depending on the size of the openings in the primary
    circuit during some shutdown states.
  — Accumulation of non-condensable gases in some parts of the primary
  — Qualification of SG water reflux, as a condensing mode of cooling,
    particularly when the non-condensable gas inventory is large enough to
    limit heat removal by the SG.

      In cold shutdown conditions, special models of the primary circuit may be
needed due to the fact that openings (access holes) can be intentionally opened
in the pressurizer or in SGs and that a free water level exists when the RPV
head is removed. An intermediate water level in the hot leg may exist under
shutdown conditions for some plants. For such states, detailed modelling is
needed. This could possibly be done by existing codes with a sufficiently
modular structure. The sensitivity to the nodalization needs to be checked.
      Attention should be paid to the input data with regard to pressure
differences developing in the primary circuit during the initial states of
shutdown conditions. Pressure differences are of great importance in
determining flow rates and water levels in the loops.
      The presence of non-condensable gases influences the physical process
during shutdown modes, particularly when the primary circuit is open through
the venting lines. Nitrogen can accumulate in some parts of the primary circuit
and leads to unexpected re-pressurization. Thus, system computer codes need
to be capable of taking non-condensable gases into account.
      For an analysis of events occurring during operation at reactor power, the
required level of conservatism is further achieved by adoption of certain
modelling assumptions, for example by neglecting some physical processes and

by selecting bounding rather than realistic correlations. An overconservative
combination of assumptions can, on the one hand, assure sufficient safety
margins regarding acceptance criteria, but, on the other hand, may lead to a
completely unrealistic view of the course of an accident. The above mentioned
overconservatism can be particularly counterproductive in an analysis of
accidents during shutdown modes, where the correct operator action plays a
decisive role and the time margin to perform such action often represents the
main result of this analysis. It is therefore important that the computer codes
used, as well as the various code options, be of the best estimate type. A best
estimate analysis is recommended whenever a calculation is used to provide the
basis for the specification of adequate operator action. A reasonable
uncertainty is afterwards added to provide a time margin in which to perform
the required action.
      During shutdown modes, several protective barriers against radioactivity
releases are partly or fully degraded. On the other hand, the time available until
loss of safety functions is usually sufficiently long to perform recovery actions,
using redundant, alternate or diverse systems, components and methods.
External equipment (e.g. power sources) can also be considered as an option
for temporary replacement of a standard component, provided that measures
are taken for the possibility of its quick installation.
      For recovery actions, such systems and components can be considered
which are designed to operate under shutdown modes and which, in
accordance with procedures, either are in service or can be placed in service
(including repair) by manual or automatic actuation within an acceptable time
interval. This time interval has to consist of both diagnosis and response
components. Any consideration of manual action is to be based on carefully
checked and verified procedures. A system under maintenance can be
considered as an option for recovery only if the maintenance time is short
enough in comparison with the duration of the particular plant operational
      In the analysis, consideration needs to be given to the fact that some of
the instruments may not be operable or may produce misleading information.
This is particularly important if operator diagnosis and response are based on
instrument readings. Unavailability of instruments can be caused either by their
disconnection in accordance with operating procedures or by damage caused
by an erroneous manipulation. Another reason for the unavailability of
instruments can be an interruption of power supply to the instruments.
Misleading or confusing information can easily be obtained if an instrument is
working outside its measurement range or under unexpected operating
conditions. An example is the temperature difference measurement in the loop
with negative natural circulation flow or with stagnant fluid. Special attention

has to be devoted to such devices, which are essential to monitor RHR, such as
instruments that monitor primary coolant temperature, natural circulation flow
and RPV level.



16.1.1. Initiating events and safety aspects

      Pressure and temperature loadings of the containment structure are one
of the consequences of a LOCA, a steam line break or a feedwater line break
within the containment boundary. ‘Short term’ refers here to the initial period
of the accident encompassing the largest release rate of the primary/secondary
coolant, during which the maximum containment pressure is reached. The
containment pressurization in its short term phase results mostly from the
release of the stored energy of the RCS.
      Owing to the post-accident pressure buildup in the containment, the
release of radioactivity occurs with a potential radiological impact on the
environment. The integrity of the containment as the last barrier against
radioactivity releases is endangered by:

  — Local effects of the accident, such as jet impingement, pipe whip and
    internal missiles;
  — Combined pressure and temperature loads acting on the internal
    structures of the containment and on the containment steel wall

      Only the combined pressure and temperature loads will be dealt with in
this section. Other aspects of primary or secondary leaks, such as core cooling
or PTS, are partly covered by other sections of this report.
      The relevant acceptance criteria for the containment analysis are Nos
(14) and (15) (Section 3). It should be noted here that conservative conditions
relevant to these acceptance criteria differ substantially from the conditions
relevant to criteria for other safety aspects (see Section 10 on LOCA analysis).

16.1.2. Specific suggestions for analysis

      The initial atmospheric conditions within the containment and its sub-
compartments need to be selected so as to maximize the peak containment
pressure. The allowable ranges of the temperature, pressure and humidity prior
to the accident have to be considered.
      The mass and energy released to the containment (including their time
variation) need to be considered conservatively high, including all sources of
stored and generated energy such as heat removed by accumulators of the
ECCS and water spilled into the containment, heat transfer from the secondary
circuit, residual heat and heat generated from metal–water reactions. For all
heat sources and heat sinks, a realistic timing has to be taken into account in
order to avoid too unrealistic results. The effect of timing differs considerably
for different types of containment. Specific attention needs to be given to
modelling metal structures in the containment, since they may represent a
significant heat sink during short term pressurization.
      Pressure propagation at the very initial stage of the accident is to be
investigated taking into account post-accident water–steam–air mixture inertia,
to confirm that pressure oscillations in the containment internal volume and/or
its compartments do not endanger the containment integrity. Uncertainties in
the prediction of pressure and pressure differences need to be evaluated, for
example, by parametric analysis of the following factors which have a strong
influence on the results:

  — Nodalization;
  — Flow resistances (often represented by flow contraction coefficients) for
    the openings between subcompartments;
  — Heat exchange with solid heat absorbing/releasing structures;
  — Water carry-over through openings.

      Subcompartment nodalization schemes have to be chosen in such a way
that there is no substantial pressure gradient within a node. The nodalization
scheme needs to be verified by a sensitivity study that includes increasing the
number of nodes until the calculated peak pressures converge to small
resultant changes (nodalization sensitivity study). However, this approach is
not applicable for consideration of local phenomena, for example vortexes.
      If flow paths (flow channels, corridors, flaps and openings) are present
which are not open at the time of pipe rupture, then the flow area and flow
resistance, as a function of time after the break, have to be based on adequate

      Pressure suppression containments require additional code capabilities to
model the effectiveness of the pressure suppression function.
      For conservative calculation of the maximum pressure in the compart-
ments, the calculation of the flow rate through all the flow paths within the
model has to be based on a conservative assumption regarding water
entrainment. If not proven otherwise by experiments, a homogenous mixture in
thermal equilibrium, with 100% water entrainment, needs to be assumed.
      Appropriate safety margins have to be considered if thermal non-
equilibrium and non-uniformities in the containment atmosphere composition
are not sufficiently modelled.


16.2.1. Initiating event and safety aspects

      Long term pressure–temperature transients cover the continuation in
time of the short term containment pressurization following a loss of coolant,
as described in Section 16.1. Long term behaviour is typically analysed for a
time period of several hours until the containment internal overpressure is
sufficiently minimized and radioactive releases substantially reduced. During
this period, the containment pressure is typically decreasing, with few
temporary exceptions.
      The pressure–temperature behaviour of the post-accident containment
atmosphere results from an imbalance between heat sources and heat sinks,

(a)   Heat sources:
      — Reactor residual heat released typically by evaporation of the coolant;
      — Accumulated heat in structures of both primary and secondary
      — Heat released by potential hydrogen burning or explosions (more
        typical for SAs).
(b)   Heat sinks:
      — Heat absorption in the containment walls and other heat absorbing
      — Spray system operation;
      — Fan and vent cooler operation;
      — Pressure suppression heat sinks (water pools, water trays and ice

     — ECCS operation; the ECCS strongly influences the ways of removing
       reactor residual heat and often also affects the containment spray
       water temperature.

     The safety aspects of the accidents are as follows:

  — Internal containment overpressure together with radioactivity in the
    containment leads to radioactivity releases through containment
  — Hydrogen explosions inside the containment may endanger its
  — Containment integrity or its leaktightness may also be affected by the
    containment underpressure resulting from the heat sinks.

     Relevant acceptance criteria are Nos (8), (14) and (15) (Section 3).

16.2.2. Specific suggestions for analysis

      For long term transients with a strong non-homogeneous energy and
mass distribution in the containment, the use of a best estimate code is very
important. This is due to the strong coupling between the main parameters and
the occurrence of various local effects. In such cases, a conservative approach
could lead to an overestimation of the influence of one parameter in relation
to the others, thus providing misleading results.
      The selection of the degree of nodalization and the selection of nodes
have to be made depending on the phenomena that are expected to occur (gas
plumes, stratified conditions and a non-homogeneously or only homogeneously
mixed atmosphere).
      A realistic timing of the heat sources and heat sinks needs to be taken
into account to avoid misleading results. The containment walls and internals
have to be investigated carefully for their effect on containment pressure
reduction. Thermal resistances and capacities, including various heat transfer
modes and low conductivity coatings, need to be properly addressed. The
cooling capacity of the spray system has to be minimized for a conservative
analysis. For such an analysis, heat exchange with the containment walls has
also to be minimized, whereas the containment leakages have to be maximized
(for the calculation of releases). The capacity of the vent and fan coolers has to
be minimized. An adequate assessment of the ECCS performance has to be
made in order to determine the containment heat sources resulting from the
residual heat and additional boiling of the primary coolant.

      In the determination of the containment spray system (both active and
passive) heat removal capability, the following factors need to be taken into

  — Location of the spray headers relative to the internal structures;
  — Spray patterns due to the arrangement of nozzles;
  — Spray drop size spectrum as a function of the differential pressure across
    the nozzle;
  — Effect of the drop residence time and drop size on the heat removal

     The consideration of hydrogen sources for the containment atmosphere
needs to include:

  —   Release of hydrogen from the escaping coolant;
  —   Radiolysis of the coolant in the sump;
  —   Metal–water reaction in the core;
  —   Chemical reactions of spray water with materials in the containment.

     Thermal non-equilibrium, especially for compartments with high liquid
content, needs to be adequately accounted for. Superheating of the
containment atmosphere during stem line breaks inside the containment has to
be accounted for when analysing temperature loads.
     For the analysis of long term processes, which consequently determines
the measures needed for SA management, a very detailed nodalization is
     The equipment needed during an accident has to be qualified to
withstand the conditions during the accident; thus, a reasonable equipment
capability needs to be assumed in the analysis.
     The results of a best estimate analysis require as a measure of their
credibility specification of their uncertainties.



     Radioactivity release is one of the safety aspects for several DBA
scenarios. The following cases may be examples of such events:

  — LOCAs with radionuclides escaping into the containment and releases
    into the environment through containment leakages;
  — Accidents with leaks from the primary circuit bypassing the containment,
    such as instrument line rupture and PRISE leaks;
  — Leaks from the primary circuit during maintenance, refuelling or other

      This report does not deal with transport of radioactivity originating
outside the RCS, such as that due to damage to a system containing radioactive
gases or liquids.
      With all the other safety aspects described in the corresponding sections,
this group of accidents, moreover, leads to radioactivity releases from the fuel
and the reactor coolant, their transport through the primary circuit, their
release and transport to the containment and to the radiological source term
released into the environment. The relevant acceptance criterion is No. (8)
(Section 3).


      At the time when the reactor power starts to change significantly (to
decrease or increase), increases in the iodine, caesium and other radioactive
substance concentrations need to be assumed as they are the most extensive
increases in connection with power changes that have been observed with the
type of plant in question (see also Section 11).
      The primary coolant leak rate and the time until the potential isolation of
the leak takes place have to be estimated as high, i.e. conservatively. If actions
affecting the isolation of a leak or the dispersion of radioactive substances are
automatic and designed to cope with a single failure, these actions can be
assumed to be effective.
      Radioactivity releases which are caused by the liquid part of the leaking
coolant and those which are caused by the gaseous part need to be examined

separately. It can be assumed that the concentration of radioactive materials in
the gaseous part is lower than that in the liquid coolant in the immediate
vicinity of the leak. The dispersion coefficient has to be justified by reference to
practical observations or test results. As an exception to this, it will be assumed,
however, that all the noble gases in the leaking coolant are always fully
discharged into the environment.
       If the leak occurs with a direct outflow into the environment and the
coolant is in liquid form just in front of the leak, all the radioactive substances
in the escaping coolant have to be taken into account when calculating off-site
       Steam and its radioactive contents which have leaked into the plant
systems should be assumed to be transferred into the environment in a way
which corresponds to the normal functioning of the ventilation systems.
       Part of the iodine which has mixed with the steam needs to be assumed
to be gaseous. The distribution of iodine into gas and aerosol portions has to be
       If filters are placed in the ventilation systems, the retention factors of the
filters need to be selected conservatively.
       The time of failure of fuel rods and the number of failed rods have to be
selected conservatively, taking into account the results of analyses related to
plant behaviour. The number of fuel rods having failed during a LOCA can be
obtained from the relevant analysis. However, a conservative assumption of
100% fuel failures for LB-LOCAs is often prescribed by national require-
ments. The amount of radioactivity released from the failed rods also has to be
chosen conservatively. A certain share of the radioactive substances released
from failed rods to the primary coolant enters the containment atmosphere
directly. The air–steam and liquid volume distribution pattern needs to be
       An additional release of radioactive substances from the failed rods has
to be assumed later when cooling water enters the rods and carries fission
products out from the fuel. This share of radioactive substances, which initially
ends up in the water, needs to be justified by experiments, or the assumptions
have to be conservative.
       Assumptions on the transport of radioactive substances within the
containment can be based on experiments if the results are applicable to the
situation in question. Alternatively, a conservative model may be used which
gives a slower normal release of radioactive substances from the gaseous
volume of the containment.
       If air is discharged from the containment during normal plant operation,
the mixing of radioactive substances with the discharged air needs to be
estimated conservatively. The isolation of ventilation systems may be assumed

to take place according to the design of the plant system so that any changes in
the parameters, used as protection limits during accidents, are assessed conser-
vatively. Before isolation, ventilation has to be assumed to function in the
normal way. After isolation, radioactive substances have to be assumed to mix
with the gaseous volume of the whole containment. The containment leak rate
has to be selected taking into account the tightness requirement set up for the
containment and the containment overpressure calculated during the analysis
of postulated accidents. Appropriate safety margins need to be employed for
the selection.
      The halogens which have leaked from the containment should be
assumed to be partly in inorganic compounds and partly in organic compounds.
The distribution into the various kinds of compound needs to be justified.
      The releases caused by the leaks and the potential malfunctions of the
ECCS and the leaks of the containment cooling systems outside the
containment boundary have to be taken into account conservatively.
      The ventilation of the space surrounding the containment has to be
assumed to function in the way designed for accident conditions, and the
releases arising from a containment leak need to be calculated accordingly. If
the ventilation system is used in the normal way with the filters bypassed, the
time spent in the possible switch over to the filters has to be justified.



      Severe accidents may be caused by any of the accident initiators discussed
in the preceding sections in the case of extraordinary equipment failures or
human errors, such as initiating events not considered in the design or multiple
equipment failure beyond the single failure criterion. Severe accidents are
typically identified through probabilistic safety assessments performed for each
      Examples of accident initiators include:

  —   Complete loss of power supply for an extended period of time;
  —   Complete loss of feedwater for an extended period of time;
  —   LOCA combined with failure of the ECCS;
  —   LOCA combined with failures of long term RHR or recirculation water

       External events which result in one or more of the preceding initiators are
also considered in the probabilistic safety assessments. As indicated above,
initiating events involving power excursions or overpower accidents which
result in fuel melting or cladding failure are not normally considered, since the
probability of such accidents has been shown to be relatively low compared
with that of initiators involving loss of cooling. The notable exception may be
consideration of the influence of a recriticality of the core associated with the
liquefaction of core control materials in combination with the addition of
unborated or insufficiently borated water.
       Severe accidents can lead to a failure of the barriers for fission product
release to the environment, including containment overpressure due to the
combustion of flammable gases in the containment, direct heating of the
containment atmosphere due to the high pressure ejection of molten corium
from the vessel, or direct thermal attack of the containment wall by molten
corium. Severe accidents can also include the release of radioactive materials
into the environment through the failure of system components bypassing the
containment boundaries.
       The acceptance criteria for SAs are typically less prescriptive than the
criteria developed for DBAs. In general terms, the probability and/or the conse-
quences of SAs must be shown to be extremely small. In some cases, SA policy
statements define the overall goals for core melt and the risk to the population
in probabilistic terms. Directly measurable criteria, similar to the peak cladding
temperature limits defined for LOCAs, are basically not included. In other
cases, the goals are defined in more absolute terms, although probabilistic
assessments are still considered. As an example, acceptance criteria
Nos (20)–(22) (Section 3) can be used for the analysis.


      The influence of plant initial conditions is less significant for SA
conditions since these accidents generally occur over a relatively long period of
time compared with DBAs. It is typically assumed that the core operates for a
long time at full power and under equilibrium conditions to maximize the
decay heat and fission product inventory. In some cases, for example in the
assessment of the response of a passive reactor design to SA conditions, a
conservative estimate for decay power is required. However, owing to the non-
linear nature of the response of the plant, assigning a maximum core decay heat
may not result in the most conservative values for the consequences of an

      The design of the plant and, in particular, of the reactor core is much more
important for SA conditions. For example, chemical interactions between
different materials in the core can have a significant influence on the
progression of core damage and on the release of hydrogen and radionuclides
into the containment. Chemical interactions between fuel and cladding,
between grid spacers and cladding, and in CR/blade structures can change the
liquefaction and relocation of core materials over a wide range of temperatures
and conditions. The rate of core heating, which is influenced by the decay heat
in the core and the thermohydraulics of the system, is also much more
important than in other accident sequences and can have a significant impact
on the progression of damage, the chemical form of the radionuclides released
into the containment, and the amount of hydrogen produced. As in the
preceding example of decay heat, it is not possible to establish conservative
design or physical parameters, due to the non-linearity of the plant response.
      Best estimate approaches are used almost exclusively to describe the
overall response of the plant during SA conditions. In some cases, conservative
assumptions are used for some portion of the analysis to evaluate a specific
response of the plant. For example, in evaluations of direct containment
heating of US reactor designs, conservative assumptions were used in
combination with detailed best estimate calculations to establish that direct
containment heating was not a significant contributor to the risk of
containment failure under loss of plant electric power. However, the same
assumptions resulted in non-conservative estimates of the hydrogen release to
the containment and thus could not be used to evaluate the risk of containment
failure due to hydrogen combustion.
      The analysis of SAs requires consideration of a much wider range of
physical phenomena than that of DBAs. In addition to the assessment of the
thermohydraulic response of the system required for DBAs, it is necessary to
analyse phenomena including the heating and melting of the core, steam
explosions, melt–concrete interactions, hydrogen and other non-condensable
gas combustion, and fission product behaviour.
      The analysis of SAs typically uses a multi-tiered approach with multiple
codes, including the detailed system and containment analysis codes, more
simplified risk assessment codes and other ‘separate effects’ codes. In most
cases, detailed multidimensional system calculations are required to describe
the response of the reactor coolant system, including multi-dimensional calcu-
lations to account for natural circulation flow patterns in the vessel and reactor
coolant system piping, the initial failure and relocation of fuel rod and
CR/blade materials, the growth of molten pools in the core and lower plenum
regions, and the heat-up and failure of the reactor vessel.

     Owing to the complexity of SAs, special guidance documents are being
prepared for their analysis.


      Detailed suggestions for evaluation and presentation of results have been
presented in Ref. [3]. Only specific suggestions concerning selection of the
parameters to be presented are included in this report. The presentation of
results of an analysis for any individual event should include a set of key
parameters, which are plotted as a function of time. Selection of the set needs
to reflect the nature and the complexity of the process analysed. The basic
requirements for selection of the set include:

  — Good understanding and interpretation of the course of the accident;
  — Possibility for checking of each acceptance criterion;
  — Coverage of the key phenomena expected to occur during the course of
    the accident;
  — Coverage of the process until stabilization of the safe condition.

      The final selection of plots has to be made taking the applicability of the
above suggestions into account.
      For scenarios with a single phase coolant in the primary circuit, typical
sets of parameters to be plotted are:

  — Core thermal power;
  — Total core reactivity, as well as partial contributions from Doppler
    reactivity, moderator temperature and voids;
  — Pressurizer pressure;
  — SG secondary side pressures;
  — Core entrance and exit coolant temperatures;
  — Pressurizer water level;
  — Boron concentration in the core;
  — Core mass flow rate;
  — Mass flow rate in individual loops;
  — Heat flux to the coolant in the core;
  — Heat transfer rate to the secondary side;
  — Primary to secondary leak mass flow rate;
  — ECCS injection mass flow rate;
  — Make-up system injection mass flow rate;

  — Boron injection system mass flow rate;
  — Break flow and enthalpy; if applicable (LOCAs, breaks of feedwater or
    steam lines);
  — Main and auxiliary/emergency feedwater injection mass flow rate;
  — Steam mass flow rate to turbine, through turbine bypass, and through
    secondary side relief and safety valves;
  — SG mixture and liquid levels;
  — MCP speed;
  — Maximum fuel temperature on average and in the hot fuel rod;
  — Maximum cladding temperature;
  — Minimum DNB margin;
  — Peaking factor above which rods experience DNB, if it occurs;
  — Maximum radially averaged fuel pellet enthalpy;
  — Total primary circuit coolant inventory;
  — Mass flow rate through pressurizer safety and relief valves;
  — Pressure in the pressurizer relief tank;
  — Coolant outflow and enthalpy from the pressurizer relief tank (in the case
    of loss of tank integrity).

     For scenarios with a two phase coolant in the primary circuit, besides all
the plots already indicated above, plots of the following parameters are to be

  — Pressure in the reactor upper plenum, near the break, in the SG and in the
    main steam header;
  — Coolant temperature at the outlet from all the loops to the reactor, in the
    downcomer, in the lower plenum, in the upper plenum, and the saturation
    temperature corresponding to the pressurizer pressure;
  — Total liquid volume in the primary circuit;
  — Mixture and collapsed levels in the pressurizer, downcomer, lower
    plenum, core, upper plenum, hot and cold leg loop seals in individual
    loops and SGs;
  — Total mass of coolant in the primary and secondary circuits, and total
    mass of coolant loss from the primary circuit;
  — Maximum thickness of oxide layer on the cladding;
  — Total amount of hydrogen produced;
  — Number of fuel rods damaged;
  — Fuel rod deformations;
  — Cladding temperature at different axial positions of hot fuel rods during
  — Internal fuel rod gas pressure.

     For analysis of the containment pressurization, the following parameters
should be typically reported in addition:

  —   Mass flow rate and enthalpy of the coolant outflow;
  —   Maximum containment pressure and temperature;
  —   Differential pressures between compartments;
  —   Post-accident temperatures in various compartments;
  —   Mixture flows through selected openings;
  —   Thermal power released from various energy sources into the
  —   Containment temperature and composition of the atmosphere (air and
      hydrogen content) in various compartments;
  —   Leakages/releases from the containment into the environment;
  —   Sump water temperature;
  —   Thermal power removed by the spray system, heat absorption and other
      heat sinks.

     If radioactivity transport is involved in the analysis, the list of reported
parameters needs to further include:

  — Concentrations of radionuclides in the fuel, the coolant and their deposits
    on the RCS structures;
  — Concentrations of radionuclides in the containment atmosphere and in
    deposits on the containment structures;
  — Quantity, composition and time period for the discharge of radioactive
    materials to the environment.

     For specialized PTS analysis, besides all the parameters relevant for the
overall thermohydraulic behaviour of the systems, the following additional
parameters need to be reported:

  — Coolant temperature in the reactor inlet nozzle as a function of time;
  — Coolant temperature in the downcomer as a function of position and
  — Coolant to wall heat transfer coefficient field;
  — Temperature distribution in the RPV wall in analysed areas as a function
    of time;
  — Stress field through the RPV wall in analysed areas as a function of time;
  — Postulated defect characteristics;
  — Stress intensity factors for postulated defects with respect to crack front

  — Crack depth and shape as functions of temperature and time.

      Finally, for analysis of SAs, additional parameters reflecting degradation
of the core and potentially also of the containment need to be reported:

  — RCS temperatures, flow rates and pressures; including natural circulation
    flow patterns in the vessel and system piping;
  — Core, vessel and RCS structure temperatures;
  — Changes in core geometry, including the melting and relocation of core
    structures, the formation of debris beds associated with collapse of the
    core or core reflood, and the formation, growth and collapse of molten
    core materials;
  — Oxidation of core structures, including the production of hydrogen;
  — Concentration of radionuclides in the fuel, coolant and deposits on RCS
  — Containment atmosphere temperatures, flow rates and pressures;
  — Concentrations of hydrogen and other non-condensable gases in the
    containment atmosphere;
  — Concentrations of radionuclides in the containment atmosphere and
    deposits on the containment surfaces;
  — Changes in molten core/containment floor geometry due to
    core–concrete interactions.

     Plants: Design, Safety Standards Series No. NS-R-1, IAEA, Vienna (2000).
     Verification for Nuclear Power Plants, Safety Standards Series No. NS-G-1.2,
     IAEA, Vienna (2001).
     Nuclear Power Plants, Safety Reports Series No. 23, IAEA, Vienna (2002).
     Analysis of WWER Nuclear Power Plants, Rep. IAEA-EBP-WWER-01, IAEA,
     Vienna (1995).
     Pressurized Thermal Shock Analysis for WWER Nuclear Power Plants, Rep.
     IAEA-EBP-WWER-08, IAEA, Vienna (1997).

     without Scram for WWER Reactors, Rep. IAEA-EBP-WWER-12, IAEA, Vienna
     440/213 Containment Evaluation, Rep. IAEA-TA-7488, WWER-SC-170, IAEA,
     Vienna (1996).
 [8] INTERNATIONAL ATOMIC ENERGY AGENCY, Procedures for Analysis of
     Accidents in Shutdown Modes for WWER Nuclear Power Plants, Rep. IAEA-
     EBP-WWER-09, IAEA, Vienna (1997).
     Leaks in WWER Nuclear Power Plants, Rep. IAEA-EBP-WWER-13, IAEA,
     Vienna (2000).
[10] NUCLEAR REGULATORY COMMISSION, Standard Format and Content of
     Safety Analysis Reports for Nuclear Power Plants (LWR Edition), Regulatory
     Guide 1.70, US Govt Printing Office, Washington, DC (1979).
[11] NUCLEAR REGULATORY COMMISSION, Standard Review Plan for the
     Review of Safety Analysis Reports for Nuclear Power Plants, Rep. NUREG-0800,
     US Govt Printing Office, Washington, DC (1982).
     and Accident Analysis for Justification of Technical Solutions at Nuclear Power
     Plants, STUK, Helsinki (1996).
[13] ENERGOATOMIZDAT, General Regulations for Nuclear Power Plant Safety
     (OPB-88), Rep. PNAE G-1-011-89, Energoatomizdat, Moscow (1990) (in
     Russian, English translation available).
[14] ENERGOATOMIZDAT, Standard Format of Technical Substantiation of
     Nuclear Power Plant Safety (TS TOB AS-85), Rep. PNAE G-1-01-85,
     Energoatomizdat, Moscow (1987) (in Russian).
[15] ELECTRICITÉ DE FRANCE, FRAMATOME, Design and Construction Rules
     for System Design of 900 MW(e) PWR Nuclear Power Plants, Rule SIN 3130/84,
     Rev. 4, Ministry of Industry and Research, Paris (1991).
[16] FEDERAL MINISTRY OF THE INTERIOR, Compilation of Information for
     Review Purposes under Licensing and Supervision Procedures for Nuclear Power
     Plants, RSK Guideline, FMI, Bonn (1982).


Allison, C.              Innovative Systems Software, United States of America

Balabanov, E.            ENPRO CONSULT Ltd, Bulgaria

D’Auria, F.              University of Pisa, Italy

Jankowski, M.            International Atomic Energy Agency

Mišák, J.                International Atomic Energy Agency

Munhoz-Camargo, C.       International Atomic Energy Agency

Salvatores, S.           Electricité de France, France

Snell, V.                Atomic Energy of Canada Limited, Canada

                              Consultants Meetings
     Vienna, Austria: 9–13 June 1997, 17–21 November 1997, 12–16 January 1998,
                  5–9 October 1998, 27 September–2 October 1999

                           Technical Committee Meeting

                   Vienna, Austria: 30 August–3 September 1999


Shared By: